<html>
<head><meta charset="utf-8"><title>Pointer provenance is real · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html">Pointer provenance is real</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="219867203"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219867203" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219867203">(Dec 14 2020 at 16:38)</a>:</h4>
<p>I wrote a <a href="https://www.ralfj.de/blog/2020/12/14/provenance.html">blog post</a> about what does wrong when one pretends that pointers do not have provenance. It might be interesting to the people in this stream. :)</p>



<a name="219867405"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219867405" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219867405">(Dec 14 2020 at 16:39)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> some time ago we spoke about pointer provenance and integer-pointer-roundtrips; this post contains a concrete example of how optimizing away an integer-pointer roundtrip (plus two other common optimizations) introduces a miscompilation.</p>



<a name="219867612"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219867612" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219867612">(Dec 14 2020 at 16:40)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> this is also related to <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/264#issuecomment-744176375">the LLVM compiler bug you noticed here</a></p>



<a name="219869623"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219869623" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219869623">(Dec 14 2020 at 16:55)</a>:</h4>
<p>Nice post.  Hope it gets some interesting HN discussion.  Some feedback: You say you assume <code>int</code> can store a pointer value for simplicity, but since most people these days write for platforms where <code>int</code> cannot store a pointer value, I think it's just unnecessarily distracting.  If I were you I'd just swap it out for <code>uintptr_t</code>.</p>



<a name="219877109"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219877109" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219877109">(Dec 14 2020 at 17:50)</a>:</h4>
<blockquote>
<p>You say you assume int can store a pointer value for simplicity, but since most people these days write for platforms where int cannot store a pointer value, I think it's just unnecessarily distracting. If I were you I'd just swap it out for uintptr_t.</p>
</blockquote>
<p>Fair... I am just too used to using <code>int</code> here but that's because I learned C on a 32bit machine and didn't write much C since 64bit is commonplace. ;) Fixed that, I hope I didn't screw this up.</p>



<a name="219877173"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219877173" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219877173">(Dec 14 2020 at 17:50)</a>:</h4>
<blockquote>
<p>Nice post. Hope it gets some interesting HN discussion.</p>
</blockquote>
<p>Thanks! Me, too -- I hope someone posts it there (so far that usually happened for my posts but I don't know who did it^^)</p>



<a name="219877277"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219877277" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219877277">(Dec 14 2020 at 17:51)</a>:</h4>
<p>I first meant to make the post just "here's this funny sequence of examples" but somehow it turned into something more opinionated than I originally intended. ;) I am curious how people will react to that.</p>



<a name="219877687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219877687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219877687">(Dec 14 2020 at 17:54)</a>:</h4>
<p>It has already been posted 1 hour ago: <a href="https://news.ycombinator.com/item?id=25419740">https://news.ycombinator.com/item?id=25419740</a> Currently at 4 points though.</p>



<a name="219877974"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219877974" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219877974">(Dec 14 2020 at 17:57)</a>:</h4>
<p>I see that you briefly touched on "option 3" where nothing has provenance. I wish people took that model more seriously; I'm personally convinced that it's possible to get some optimizations with an SB-like setup but without provenance in memory.</p>



<a name="219878519"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219878519" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219878519">(Dec 14 2020 at 18:00)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219877974">said</a>:</p>
<blockquote>
<p>I see that you briefly touched on "option 3" where nothing has provenance. I wish people took that model more seriously; I'm personally convinced that it's possible to get some optimizations with an SB-like setup but without provenance in memory.</p>
</blockquote>
<p>So that's some kind of middle-ground where provenance exists on the value level but gets lost when the value is put into memory? I personally would be very surprised if that was possible (as you know since this came up in some issue or Zulip thread before), but this is certainly worth exploring. In particular I am worried by the complexities arising from having local variables inside a function not be stored in memory but in some other, non-addressable location. This could mean that local variables follow very different rules depending on whether they have their address taken or not, which seems... odd at least. (By "possible" I mean getting a compiler that can compete in terms of performance and has comprehensible rules; defining the model itself of course is very possible.)</p>



<a name="219879388"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219879388" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219879388">(Dec 14 2020 at 18:06)</a>:</h4>
<p>It is possible to do alias analysis without storing alias information "in" the values, in the same way that it is possible to do value range analysis without having some special magic value that represents the range. What are the main optimizations we think can't be done without provenance? One that comes to mind is malloc-removal, but I think this can also be handled by saying that it is UB to write to memory owned by the allocator.</p>



<a name="219879668"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219879668" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219879668">(Dec 14 2020 at 18:08)</a>:</h4>
<blockquote>
<p>What are the main optimizations we think can't be done without provenance?</p>
</blockquote>
<p>the post lists one as an example -- the third optimization in the chain</p>



<a name="219879755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219879755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219879755">(Dec 14 2020 at 18:09)</a>:</h4>
<p>basically, anything based on <code>noalias</code>, <code>restricted</code>, or "this ptr arithmetic must have stayed in-bounds" relies on provenance</p>



<a name="219879799"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219879799" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219879799">(Dec 14 2020 at 18:09)</a>:</h4>
<p>From a rustic POV that write to p+1 is bogus anyway</p>



<a name="219879876"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219879876" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219879876">(Dec 14 2020 at 18:10)</a>:</h4>
<p>there's no write to p+1 in the original program</p>



<a name="219880080"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880080" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880080">(Dec 14 2020 at 18:11)</a>:</h4>
<blockquote>
<p>It is possible to do alias analysis without storing alias information "in" the values, in the same way that it is possible to do value range analysis without having some special magic value that represents the range.</p>
</blockquote>
<p>I think you are mixing up two levels here: there's the operational semantics of the language, and there is the static analysis that tries to predict properties that all executions of a certain program will have in common. The latter must be justified against the former. Both alias analysis and range analysis are examples of the latter.<br>
but if you define your operational semantics without provenance, then there will be much fewer "doesn't alias" results that the alias analysis can correctly return. provenance is about adding more UB to the language so that alias analysis can more often say "doesn't alias" without being wrong.</p>



<a name="219880180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880180">(Dec 14 2020 at 18:12)</a>:</h4>
<p>of course you can do alias analysis on a provenance-free language. that's like doing alias analysis on assembly.</p>



<a name="219880262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880262">(Dec 14 2020 at 18:13)</a>:</h4>
<p>Not necessarily, because the high level operations can come with annotations that assert inbounds of various kinds</p>



<a name="219880280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880280">(Dec 14 2020 at 18:13)</a>:</h4>
<p>and every compiler engineer I spoke to said that's just not an option if you want your C/C++ compiler to be competitive.</p>



<a name="219880281"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880281" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880281">(Dec 14 2020 at 18:13)</a>:</h4>
<p>that doesn't itself require provenance</p>



<a name="219880320"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880320" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880320">(Dec 14 2020 at 18:13)</a>:</h4>
<p>this depends on the kind of "inbounds"</p>



<a name="219880368"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880368" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880368">(Dec 14 2020 at 18:14)</a>:</h4>
<p>C/LLVM-style inbounds does require provenance as this post demonstrates</p>



<a name="219880415"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880415" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880415">(Dec 14 2020 at 18:14)</a>:</h4>
<p>and Rust inherits that notion</p>



<a name="219880430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880430">(Dec 14 2020 at 18:14)</a>:</h4>
<p>I don't deny that</p>



<a name="219880464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880464">(Dec 14 2020 at 18:14)</a>:</h4>
<p>I agree that everyone in the space is firmly convinced that provenance is a part of life</p>



<a name="219880510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880510">(Dec 14 2020 at 18:15)</a>:</h4>
<p>except possibly end users</p>



<a name="219880539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880539">(Dec 14 2020 at 18:15)</a>:</h4>
<p>of course one could imagine a completely different approach to all of that. like, a clean-slate redesign of the LLVM memory model with the goal of having no provenance, or only having it in a limited form.</p>



<a name="219880669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880669">(Dec 14 2020 at 18:16)</a>:</h4>
<p>yeah I realize it's not the sort of thing to hope for in LLVM 12 or what have you</p>



<a name="219880670"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880670" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880670">(Dec 14 2020 at 18:16)</a>:</h4>
<p>but that's ivry tower theoretical talk at this point; a <em>lot</em> needs to be worked out to make this a concrete proposal that one can even comment on. so it's interesting, but unfortunately unlikely to affect Rust or LLVM meaningfully.</p>



<a name="219880741"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880741" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880741">(Dec 14 2020 at 18:17)</a>:</h4>
<p>fair enough. I shall return to my ivory tower then</p>



<a name="219880751"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880751" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880751">(Dec 14 2020 at 18:17)</a>:</h4>
<p>I love ivory tower theoretical talk, don't get me wrong. :) but I also love making Rust better, and I doubt this kind of redesign is going to help with that, even if it does work out in the end.</p>



<a name="219880908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219880908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219880908">(Dec 14 2020 at 18:18)</a>:</h4>
<p>But maybe I am wrong about that and then I will be very happy to ditch provenance at the first opportunity ;)</p>



<a name="219881024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881024">(Dec 14 2020 at 18:19)</a>:</h4>
<p>I want to make rust better, but I also want to make the best possible language, and I am always a bit sad when it seems like rust can't fill both roles</p>



<a name="219881056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881056">(Dec 14 2020 at 18:19)</a>:</h4>
<p>yeah I feel you</p>



<a name="219881134"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881134" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881134">(Dec 14 2020 at 18:20)</a>:</h4>
<p>but then I remind myself of how much better Rust is than the previous state of the art in this space ;)</p>



<a name="219881277"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881277" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881277">(Dec 14 2020 at 18:21)</a>:</h4>
<p>at one of the Rust All Hands, not sure which year, Aaron (I think) gave a great little speech about how Rust has a great mixture of people where some want to make everything absolutely perfect (I consider myself to be in this camp, mostly, even if this discussion might make it seem differently) and others keep pushing for shipping <em>something</em> so we can get things into the hands of users. if you'd let people like us lead Rust there'd never be a 1.0 release and so Rust would never actually improve the world. ;)</p>



<a name="219881456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881456">(Dec 14 2020 at 18:23)</a>:</h4>
<p>I definitely should write a blog post or a paper about this if only to get my thoughts in order, but my current project that will answer some of these questions is a multi-year endeavor</p>



<a name="219881525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881525">(Dec 14 2020 at 18:23)</a>:</h4>
<p>yeah</p>



<a name="219881655"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881655" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881655">(Dec 14 2020 at 18:24)</a>:</h4>
<p>it turns out writing a language semantics is hard, who knew?</p>



<a name="219881673"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219881673" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219881673">(Dec 14 2020 at 18:24)</a>:</h4>
<p>:D</p>



<a name="219889131"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219889131" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219889131">(Dec 14 2020 at 19:19)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I appreciate the blog post; it's a clearer explanation of the problem than I've seen anywhere else.</p>



<a name="219889229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219889229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219889229">(Dec 14 2020 at 19:20)</a>:</h4>
<p>I do have disagreements with some of the conclusions, but now I have a better framework with which to reason about them.</p>



<a name="219889537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219889537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219889537">(Dec 14 2020 at 19:22)</a>:</h4>
<p>My reaction to the C example is that signed overflow being UB was a historical artifact of the standard allowing non-two's-complement representations, and now that C2x mandates the two's complement representation, the standard <em>should</em> define signed overflow as wrapping just as it does for unsigned overflow.</p>



<a name="219890047"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890047" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890047">(Dec 14 2020 at 19:24)</a>:</h4>
<p>The common argument for not defining signed overflow is that everyone uses <code>int</code> in loop counters and yet <code>int</code> is 4 bytes on modern machines rather than the native size because this would have broken too much code at the beginning of the 64-bit era</p>



<a name="219890056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890056">(Dec 14 2020 at 19:24)</a>:</h4>
<p>(That's for C. In Rust I'm thankful we have Wrapping for such cases.)</p>



<a name="219890184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890184">(Dec 14 2020 at 19:24)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span>  Many people agree with you, but C++20 at least explicitly decided <em>not</em> to define signed overflow, and I doubt C2x will do any different although you may know better.</p>



<a name="219890208"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890208" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890208">(Dec 14 2020 at 19:25)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> Why is that an argument for not defining overflow?</p>



<a name="219890260"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890260" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890260">(Dec 14 2020 at 19:25)</a>:</h4>
<p>Personally, I'm skeptical that signed overflow being UB for optimization is still justified in a world where loop counters are often size_t anyway.</p>



<a name="219890262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890262">(Dec 14 2020 at 19:25)</a>:</h4>
<p>By assuming integers don't wrap, compilers are allowed to use native words anyway</p>



<a name="219890370"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890370" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890370">(Dec 14 2020 at 19:26)</a>:</h4>
<p>personally I think this is a really dubious way to get this optimization, but it is what it is</p>



<a name="219890376"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890376" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890376">(Dec 14 2020 at 19:26)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> I don't think that matters in practice unless you're on a platform with no concept of 32-bit values.</p>



<a name="219890406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890406">(Dec 14 2020 at 19:26)</a>:</h4>
<p>And no instruction for 32-bit arithmetic.</p>



<a name="219890408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890408">(Dec 14 2020 at 19:26)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> Think of things like optimizing array indexing into pointer arithmetic.</p>



<a name="219890452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890452">(Dec 14 2020 at 19:27)</a>:</h4>
<p>If you use <code>i32</code> as a counter then there is an extra sign extend in the loop</p>



<a name="219890459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890459">(Dec 14 2020 at 19:27)</a>:</h4>
<p>like <code>for (int i = 0; i &lt; 10; i++) foo(a[i]);</code> --&gt; <code>for (i = 0, ptr = a; i &lt; 10; i++, ptr++) foo(*ptr);</code></p>



<a name="219890540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890540">(Dec 14 2020 at 19:27)</a>:</h4>
<p>But anyway, this is way off topic.</p>



<a name="219890667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890667">(Dec 14 2020 at 19:28)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> I'm aware that C2x and C++20 don't define signed overflow. Unfortunately, there are folks in the C and C++ standards who fight for UB because they have optimizations that rely on it, even if the UB itself was not originally motivated by those optimizations.</p>



<a name="219890762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890762">(Dec 14 2020 at 19:29)</a>:</h4>
<p>So C2x also does not?  That's the part I wasn't sure about.</p>



<a name="219890791"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890791" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890791">(Dec 14 2020 at 19:29)</a>:</h4>
<p>Yeah, unfortunately not.</p>



<a name="219890798"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890798" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890798">(Dec 14 2020 at 19:29)</a>:</h4>
<p>Personally, I don't see that as necessarily unfortunate.  But it is <em>potentially</em> unfortunate if the optimizations are not useful enough.</p>



<a name="219890982"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219890982" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219890982">(Dec 14 2020 at 19:30)</a>:</h4>
<p>If the optimizations are useful, the compiler could still potentially make them if it can prove that they are correct. That puts an additional burden on the compiler before it can do such optimizations, but that doesn't make the optimizations impossible.</p>



<a name="219891110"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219891110" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219891110">(Dec 14 2020 at 19:32)</a>:</h4>
<p>Going back to the blog post: along the same lines, I find it unfortunate that the third possibility is dismissed so strongly.</p>



<a name="219891223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219891223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219891223">(Dec 14 2020 at 19:33)</a>:</h4>
<p>See also <a href="https://youtu.be/yG1OZ69H_-o?t=2357">https://youtu.be/yG1OZ69H_-o?t=2357</a> for an example where overflow UB is used for optimization</p>
<div class="youtube-video message_inline_image"><a data-id="yG1OZ69H_-o" href="https://youtu.be/yG1OZ69H_-o?t=2357"><img src="https://i.ytimg.com/vi/yG1OZ69H_-o/default.jpg"></a></div>



<a name="219891563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219891563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219891563">(Dec 14 2020 at 19:35)</a>:</h4>
<p>Couldn't the C/C++ standard define that it is allowed for the compiler to arbitrarily widen signed integers instead of making it straight up UB to do signed overflow? Signed overflow would then still not be completely defined, but at least the options are much more limited.</p>



<a name="219891786"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219891786" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219891786">(Dec 14 2020 at 19:37)</a>:</h4>
<p>Examples are good, but I think the world needs a lot more hard numbers and research: what is the cost of -fno-strict-overflow, <em>why</em>, how much of that cost can be recovered by improving optimizations...</p>



<a name="219891908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219891908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219891908">(Dec 14 2020 at 19:38)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> so, instead of changing the two integer types to be signed, as far as I can tell it would suffice to change them both to be pointer-sized.</p>



<a name="219892231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892231">(Dec 14 2020 at 19:41)</a>:</h4>
<p>And in Rust, it'd be OK to use any non-wrapping integer, or a wrapping integer that's at least pointer-sized.</p>



<a name="219892262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892262">(Dec 14 2020 at 19:41)</a>:</h4>
<p>In Rust it doesn't matter because approximately nobody uses i32s as array indices.</p>



<a name="219892285"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892285" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892285">(Dec 14 2020 at 19:41)</a>:</h4>
<p>Right.</p>



<a name="219892386"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892386" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892386">(Dec 14 2020 at 19:42)</a>:</h4>
<p>Though <code>arr[x as usize]</code> is not ridiculously rare. I have code like that.</p>



<a name="219892406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892406">(Dec 14 2020 at 19:42)</a>:</h4>
<p>(not for i32 though)</p>



<a name="219892522"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892522" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892522">(Dec 14 2020 at 19:43)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I appreciate footnote 4, and I agree that I'd rather have some backing data.</p>



<a name="219892906"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892906" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892906">(Dec 14 2020 at 19:46)</a>:</h4>
<p>So, suppose you don't have provenance.  The first question is whether you allow guessing pointers "out of thin air".  Suppose you have</p>
<div class="codehilite"><pre><span></span><code>int a = 0;
*(int *)0x1234 = 99;
return a;
</code></pre></div>
<p>and the compiler happens to store <code>a</code> on the stack at address <code>0x1234</code>.  Is this program well-defined?</p>



<a name="219892983"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219892983" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219892983">(Dec 14 2020 at 19:47)</a>:</h4>
<p>If the answer is yes, then you sort of can't optimize anything ever.</p>



<a name="219893008"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893008" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893008">(Dec 14 2020 at 19:47)</a>:</h4>
<p>At least when variables are involved.</p>



<a name="219893088"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893088" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893088">(Dec 14 2020 at 19:47)</a>:</h4>
<p>I discuss another option earlier above, but it could also be implementation defined, as in if you guess right then it's fine, same as layout optimization</p>



<a name="219893171"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893171" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893171">(Dec 14 2020 at 19:48)</a>:</h4>
<p>Sure, I'm asking if it's well-defined on an implementation where the choice happens to be right.</p>



<a name="219893206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893206">(Dec 14 2020 at 19:48)</a>:</h4>
<p>let's say yes</p>



<a name="219893272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893272">(Dec 14 2020 at 19:49)</a>:</h4>
<p>the compiler can still do the optimization because it can just change what "implementation defined" means in this case</p>



<a name="219893298"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893298" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893298">(Dec 14 2020 at 19:49)</a>:</h4>
<p>But what exactly is the definition?</p>



<a name="219893312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893312">(Dec 14 2020 at 19:49)</a>:</h4>
<p>One possibility is to special-case variables that don't have their address taken.</p>



<a name="219893323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893323">(Dec 14 2020 at 19:49)</a>:</h4>
<p>whatever it happens to do after all optimizations</p>



<a name="219893419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893419">(Dec 14 2020 at 19:50)</a>:</h4>
<p>I don't know what that means, but I'm going to continue with my monologue for a sec :)</p>



<a name="219893732"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893732" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893732">(Dec 14 2020 at 19:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219892386">said</a>:</p>
<blockquote>
<p>Though <code>arr[x as usize]</code> is not ridiculously rare. I have code like that.</p>
</blockquote>
<p>(I'd personally like it just support indexing with any integer primitive, the same way we support shifting by any integer primitive.  I don't know how often that's using <code>x</code> as a loop counter, though, as opposed to using it more like a lookup table.)</p>



<a name="219893746"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219893746" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219893746">(Dec 14 2020 at 19:53)</a>:</h4>
<p>(me too)</p>



<a name="219894019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894019">(Dec 14 2020 at 19:56)</a>:</h4>
<p>...Special-casing variables that don't have their address taken is a start, but what if it did have its address taken, but in a trivial way?</p>
<div class="codehilite"><pre><span></span><code>int a;
*&amp;a = 1; // maybe this was expanded from a macro or inline function
*(int *)0x1234 = 99;
return a;
</code></pre></div>
<p>If that were allowed to modify <code>a</code>, it would be less bad, but still pretty bad.</p>
<p>There's still one possible way to make it UB without provenance, which is to basically lie about the address.  After all, the address is unobservable in 'normal' operation.  So even if the assembly code stores <code>a</code> at 0x1234, you can claim for formal purposes it was actually stored at 0x5678 or something.  That's similar to the "twin allocation" idea @Ralf Jung worked on.</p>
<p>But it's also very weird, so I don't know if it's really any better than provenance.</p>



<a name="219894684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894684">(Dec 14 2020 at 20:02)</a>:</h4>
<p>Now, those examples are in C.  One option is to give up on C and say we only care about Rust, and for Rust we'll use SB instead.  But the current SB formalization depends on at least references having provenance.  I'm curious, <span class="user-mention" data-user-id="271719">@Mario Carneiro</span>, how you would formalize SB without it.</p>



<a name="219894801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894801">(Dec 14 2020 at 20:03)</a>:</h4>
<p>Well it wouldn't be SB really, that model basically has provenance-in-memory right in the name</p>



<a name="219894830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894830">(Dec 14 2020 at 20:03)</a>:</h4>
<p>but something with equivalent aliasing properties would be the goal</p>



<a name="219894837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894837">(Dec 14 2020 at 20:03)</a>:</h4>
<p>Then what would it be? :) I guess that's a blog-post-sized question.</p>



<a name="219894997"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219894997" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219894997">(Dec 14 2020 at 20:04)</a>:</h4>
<p>I really need to learn how to write a blog</p>



<a name="219895030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895030">(Dec 14 2020 at 20:05)</a>:</h4>
<p>all the cool kids are doing it :)</p>



<a name="219895068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895068">(Dec 14 2020 at 20:05)</a>:</h4>
<p>Can always do the easy version of making a github gist and sending it to TWiR :P</p>



<a name="219895069"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895069" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895069">(Dec 14 2020 at 20:05)</a>:</h4>
<p>But to boil it down, in</p>
<div class="codehilite"><pre><span></span><code>let mut a: i32 = 1;
*&amp;mut a = 1;

*transmute::&lt;usize, &amp;mut i32&gt;(0x1234) = 2;

return a;
</code></pre></div>
<p>How do you distinguish <code>&amp;mut a</code> from the result of the transmute such that one is dereferenceable but the other is not?</p>



<a name="219895164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895164">(Dec 14 2020 at 20:06)</a>:</h4>
<p>Again assuming that <code>a</code> ends up at 0x1234.</p>



<a name="219895367"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895367" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895367">(Dec 14 2020 at 20:09)</a>:</h4>
<p>The more radical idea is to say that that code is not accepted in the first place unless you introduce some assertion (or possibly fold this assertion into one of the operations in the example) that says that the transmuted data points to something that does not overlap any existing mut borrow</p>



<a name="219895533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895533">(Dec 14 2020 at 20:10)</a>:</h4>
<p>which would make the code UB in the case where a ends up at 0x1234</p>



<a name="219895715"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895715" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895715">(Dec 14 2020 at 20:12)</a>:</h4>
<p>Perhaps, but let's say you use a union instead of <code>transmute</code>; where do you put the assertion?</p>



<a name="219895749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895749">(Dec 14 2020 at 20:12)</a>:</h4>
<p>it is associated to the write</p>



<a name="219895805"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895805" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895805">(Dec 14 2020 at 20:13)</a>:</h4>
<p>If it's associated to the write,  why doesn't the same assertion trigger with a normal/valid write?</p>



<a name="219895811"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895811" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895811">(Dec 14 2020 at 20:13)</a>:</h4>
<p>so immediately before the operation / somewhere the compiler can pick up on it, you have to "reify" the pointee as a reference long enough to write to it</p>



<a name="219895922"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895922" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895922">(Dec 14 2020 at 20:14)</a>:</h4>
<p>The same assertion does trigger on a normal write</p>



<a name="219895973"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895973" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895973">(Dec 14 2020 at 20:14)</a>:</h4>
<p>So you have an <code>&amp;mut i32</code> with the bit pattern <code>0x1234</code>, what are you asserting about it?</p>



<a name="219895978"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219895978" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219895978">(Dec 14 2020 at 20:14)</a>:</h4>
<p>most of the time it's easy to obtain because you are following borrowing discipline</p>



<a name="219896056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896056">(Dec 14 2020 at 20:15)</a>:</h4>
<p>When you write to the reference, you assert that it does not overlap with any active mut borrows</p>



<a name="219896136"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896136" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896136">(Dec 14 2020 at 20:16)</a>:</h4>
<p>But in the case of <code>*&amp;mut a = 1;</code>, it does overlap with an active mut borrow, namely that borrow itself.</p>



<a name="219896191"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896191" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896191">(Dec 14 2020 at 20:16)</a>:</h4>
<p>obviously that one doesn't count</p>



<a name="219896218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896218">(Dec 14 2020 at 20:16)</a>:</h4>
<p>disjointness here only wrt other borrows</p>



<a name="219896414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896414">(Dec 14 2020 at 20:18)</a>:</h4>
<p>Sure.  But why not?  Well, putting it all in one statement makes it confusing, but let's say we had <code>let b = &amp;mut a; *b = 1;</code>.  How do you say that it doesn't count for <code>b</code> but does count for <code>transmute::&lt;usize, &amp;mut i32&gt;(0x1234)</code>?  How do you distinguish them, without that being equivalent to provenance?</p>



<a name="219896734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896734">(Dec 14 2020 at 20:21)</a>:</h4>
<p>I suppose you could say it's based on static properties of the reference, i.e. lifetimes, not dynamic ones.</p>



<a name="219896764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896764">(Dec 14 2020 at 20:21)</a>:</h4>
<p>But that has its own issues.</p>



<a name="219896777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896777">(Dec 14 2020 at 20:21)</a>:</h4>
<p>The assertion being made is different. One of them says that we can get a new borrow on <code>0x1234</code> that does not overlap any mut borrows in scope (in particular the one on <code>b</code>), while the other one says we reborrow <code>b</code> so we are promising that <code>b</code>, or at least the part of it in the reborrow, does not overlap any borrows in scope distinct from b</p>



<a name="219896876"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896876" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896876">(Dec 14 2020 at 20:22)</a>:</h4>
<p>The structure of who borrows who is explicit because this is rust code</p>



<a name="219896951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896951">(Dec 14 2020 at 20:22)</a>:</h4>
<p>When is the assertion made?  Before you said it was triggered on write.  But how does the write "know" whether <code>b</code> was derived from a reborrow or a transmute?</p>



<a name="219896970"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896970" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896970">(Dec 14 2020 at 20:23)</a>:</h4>
<p>Or perhaps the assertion is made on transmute, but then what do you do with unions?</p>



<a name="219896992"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219896992" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219896992">(Dec 14 2020 at 20:23)</a>:</h4>
<p>It's more like an elaboration of the code, similar to the <code>retag</code> ops in SB</p>



<a name="219897106"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897106" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897106">(Dec 14 2020 at 20:24)</a>:</h4>
<p>by looking at the input code you determine what assertions to insert, and the assertions provide the information necessary for the compiler to prove safety (unless the assertions are false and then it's UB)</p>



<a name="219897363"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897363" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897363">(Dec 14 2020 at 20:26)</a>:</h4>
<p>My feeling is that if you try to formalize this it will end up being equivalent to a form of provenance.</p>



<a name="219897488"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897488" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897488">(Dec 14 2020 at 20:27)</a>:</h4>
<p>That's possible. It seems clearer to me, although I'm sure I haven't convinced anyone else that anything I'm saying is clear</p>



<a name="219897683"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897683" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897683">(Dec 14 2020 at 20:29)</a>:</h4>
<p>in particular, I think it is important that a provenance, if you want to call it that, can exist separately from the value, travel along different control flow and get recombined later</p>



<a name="219897730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897730">(Dec 14 2020 at 20:29)</a>:</h4>
<p>I'm pretty sure that this is impossible with LLVM style provenance</p>



<a name="219897737"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897737" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897737">(Dec 14 2020 at 20:29)</a>:</h4>
<p>FWIW, I don't mean to be discouraging.  I'm just trying to help... sharpen the concept.</p>



<a name="219897821"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897821" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897821">(Dec 14 2020 at 20:30)</a>:</h4>
<p>If for no other reason than that, if I'm right that there's a missing piece to the story, it might help you find it.</p>



<a name="219897894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897894">(Dec 14 2020 at 20:31)</a>:</h4>
<p>The idea of a provenance existing separately from the corresponding value is interesting.  So it would be something like "permission to access X address"?</p>



<a name="219897904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219897904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219897904">(Dec 14 2020 at 20:31)</a>:</h4>
<p>yes</p>



<a name="219898010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219898010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219898010">(Dec 14 2020 at 20:32)</a>:</h4>
<p>When you call a function, you pass in the <del>provenances</del> permissions associated based on the types, and that's all the function gets</p>



<a name="219898093"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219898093" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219898093">(Dec 14 2020 at 20:33)</a>:</h4>
<p>so a read/write to random memory is UB</p>



<a name="219898240"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219898240" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219898240">(Dec 14 2020 at 20:34)</a>:</h4>
<p>and moreover the compiler isn't going to let you read/write random addresses even if you happen to own them because it can't prove that. You have to add some intrinsic that magics up a permission for you first</p>



<a name="219898424"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219898424" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219898424">(Dec 14 2020 at 20:36)</a>:</h4>
<p>However I think it would be difficult to support all this in rust without passing around a lot of ZSTs</p>



<a name="219898466"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219898466" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219898466">(Dec 14 2020 at 20:36)</a>:</h4>
<p>Well, keep thinking about it.</p>



<a name="219912563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219912563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219912563">(Dec 14 2020 at 22:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219892906">said</a>:</p>
<blockquote>
<p>So, suppose you don't have provenance.  The first question is whether you allow guessing pointers "out of thin air".  Suppose you have</p>
<div class="codehilite"><pre><span></span><code>int a = 0;
*(int *)0x1234 = 99;
return a;
</code></pre></div>
<p>and the compiler happens to store <code>a</code> on the stack at address <code>0x1234</code>.  Is this program well-defined?</p>
</blockquote>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219892983">said</a>:</p>
<blockquote>
<p>If the answer is yes, then you sort of can't optimize anything ever.</p>
</blockquote>
<p>Informally speaking: I think this is a case where something like <code>volatile</code> would be useful. I <em>do</em> believe it's reasonable for the compiler to, under normal circumstances, assume that a value won't be changed by random pointer writes, and thus keep it in a register without having to reload it from memory all the time. If you want a value that can be changed out from under you at any time (e.g. a buffer backed by a MMIO device or a shared memory region), you need something like <code>volatile</code> for that.</p>



<a name="219912652"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219912652" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219912652">(Dec 14 2020 at 22:39)</a>:</h4>
<p>In other words, I think it's reasonable to answer your question with "yes, you can guess a pointer out of thin air", while simultaneously stating that if you write through such a pointer, it's unspecified (but <em>not</em> UB) whether any given read of the value you wrote to observes that write.</p>



<a name="219912750"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219912750" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219912750">(Dec 14 2020 at 22:40)</a>:</h4>
<p>Which means the compiler would be allowed to optimize the last statement into <code>return 0;</code>, but is not obligated to do so, which means the function may return either 0 or 99 depending on optimization level. And I think that's perfectly OK.</p>



<a name="219912839"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219912839" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219912839">(Dec 14 2020 at 22:41)</a>:</h4>
<p>I'd much rather have more of that kind of unspecified-but-not-undefined behavior, rather than UB.</p>



<a name="219913170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913170">(Dec 14 2020 at 22:44)</a>:</h4>
<p>It's not immediately clear to me that those two options exhaustively enumerate the possibilities that common compiler optimizations will produce here. At the very least you could also get misaligned / torn reads, and inconsistent reads of the same value seem possible as well</p>



<a name="219913285"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913285" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913285">(Dec 14 2020 at 22:45)</a>:</h4>
<p>This is the space I'm comfortable working in. I'd love to see requirements like "if you access a machine-word-sized, machine-word-aligned value, you will never get a torn read; if you access a value larger than a machine word, or not aligned to a machine-word boundary, you may get a torn read".</p>



<a name="219913384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913384">(Dec 14 2020 at 22:46)</a>:</h4>
<p>but I assume that inconsistent reads would not be acceptable to you</p>



<a name="219913407"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913407" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913407">(Dec 14 2020 at 22:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219913384">said</a>:</p>
<blockquote>
<p>but I assume that inconsistent reads would not be acceptable to you</p>
</blockquote>
<p>Why do you assume that? :)</p>



<a name="219913421"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913421" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913421">(Dec 14 2020 at 22:47)</a>:</h4>
<p>i.e. you load the value once, observe it twice and see two different things</p>



<a name="219913441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913441">(Dec 14 2020 at 22:47)</a>:</h4>
<p>that's basically LLVM <code>undef</code></p>



<a name="219913451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913451">(Dec 14 2020 at 22:47)</a>:</h4>
<blockquote>
<p>Which means the compiler would be allowed to optimize the last statement into <code>return 0;</code>, but is not obligated to do so, which means the function may return either 0 or 99 depending on optimization level. And I think that's perfectly OK.</p>
</blockquote>
<p>In C and C++ at least, this is actually unspecified. The int-ptr cast has an unspecified result, which is constrained by the round-trip rule.</p>



<a name="219913548"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913548" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913548">(Dec 14 2020 at 22:48)</a>:</h4>
<p>The compiler merely chooses to simply give you an invalid pointer.</p>



<a name="219913558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913558">(Dec 14 2020 at 22:48)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> Often, especially when writing concurrent code, I found myself in the position of <em>not</em> being able to assume that referencing a value twice will only perform one load.</p>



<a name="219913608"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913608" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913608">(Dec 14 2020 at 22:48)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> The Linux kernel and some other concurrent code has special operations for "I need you to load this exactly once".</p>



<a name="219913680"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913680" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913680">(Dec 14 2020 at 22:49)</a>:</h4>
<p>In the absence of such operations, I have no problem with the idea that <code>*a + *a</code> may give you an odd number, for instance. :)</p>



<a name="219913687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913687">(Dec 14 2020 at 22:49)</a>:</h4>
<p>I'm saying suppose you use that, but get two results anyway because you loaded <code>undef</code></p>



<a name="219913774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913774">(Dec 14 2020 at 22:50)</a>:</h4>
<p>The operations I was referring to <em>can't</em> return <code>undef</code>; they're defined in machine semantics, where undef isn't a thing.</p>



<a name="219913876"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913876" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913876">(Dec 14 2020 at 22:51)</a>:</h4>
<p>It seems likely to me that reading a possibly clobbered value after optimization could well have such an effect, if the optimization only triggered at one of the uses</p>



<a name="219913901"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219913901" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219913901">(Dec 14 2020 at 22:51)</a>:</h4>
<p>So, there are two separate issues here.</p>



<a name="219914037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914037">(Dec 14 2020 at 22:53)</a>:</h4>
<p>If I load some value into a local through a volatile pointer, and then use that local, the compiler is by definition not allowed to reload the local value from the pointer. So it has to be the same consistent local value once loaded. That's important for things like MMIO or shared memory. (Similarly, if I load two local values via two loads from a volatile pointer, the compiler is not allowed to assume they loaded the same value.)</p>



<a name="219914245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914245">(Dec 14 2020 at 22:55)</a>:</h4>
<p>If I <em>don't</em> use a volatile pointer, the compiler may make such assumptions, and it's my fault if those assumptions aren't valid. That doesn't mean it's UB; it means I might get inconsistent results depending on optimizations and similar.</p>



<a name="219914300"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914300" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914300">(Dec 14 2020 at 22:55)</a>:</h4>
<p>That's talking about loads through a pointer, however.</p>



<a name="219914367"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914367" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914367">(Dec 14 2020 at 22:56)</a>:</h4>
<blockquote>
<p>That doesn't mean it's UB; it means I might get inconsistent results depending on optimizations and similar.</p>
</blockquote>
<p>That sounds tricky to define</p>



<a name="219914402"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914402" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914402">(Dec 14 2020 at 22:56)</a>:</h4>
<p>Especially because "results" are not localized to just the load itself but all uses of that load</p>



<a name="219914435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914435">(Dec 14 2020 at 22:57)</a>:</h4>
<blockquote>
<p>the compiler may make such assumptions, and it's my fault if those assumptions aren't valid.</p>
</blockquote>
<p>This is usually called UB</p>



<a name="219914550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914550">(Dec 14 2020 at 22:58)</a>:</h4>
<p>Generally "the compiler may assume X" is equivalent to "not-X is undefined behavior"</p>



<a name="219914650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914650">(Dec 14 2020 at 22:59)</a>:</h4>
<p>There's a big difference between "unspecified valid value" and "magic LLVM invoke-nasal-demons value that can't exist in real memory". :)</p>



<a name="219914680"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914680" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914680">(Dec 14 2020 at 22:59)</a>:</h4>
<p>In any case, backing up a step:</p>



<a name="219914727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914727">(Dec 14 2020 at 23:00)</a>:</h4>
<p>I'm not too worried about the case of using a non-volatile pointer to access volatile memory.</p>



<a name="219914761"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914761" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914761">(Dec 14 2020 at 23:00)</a>:</h4>
<p>And I don't want to quibble over the semantics of that case, or the definition of UB there.</p>



<a name="219914779"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914779" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914779">(Dec 14 2020 at 23:00)</a>:</h4>
<p>The distinction I was trying to make earlier (and didn't get to yet) was that that was all about loads <em>through a pointer</em>.</p>



<a name="219914939"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219914939" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219914939">(Dec 14 2020 at 23:02)</a>:</h4>
<p>If you have a local variable like <code>let a = 0;</code>, and someone makes up a pointer and scribbles through it, and that happens to overwrite <code>a</code>, that's different from making up a pointer and using it to write to a value that I'm referencing from another pointer.</p>



<a name="219915136"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915136" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915136">(Dec 14 2020 at 23:04)</a>:</h4>
<p>The same general premise applies there: if you had a raw volatile pointer to <code>a</code> and loaded through that, you could expect the exactly-one-load behavior. Otherwise, you could get behavior like <code>a + a</code> being odd, and that's OK.</p>



<a name="219915282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915282">(Dec 14 2020 at 23:06)</a>:</h4>
<p>But compiler optimizations don't obey the laws of causality</p>



<a name="219915299"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915299" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915299">(Dec 14 2020 at 23:06)</a>:</h4>
<p>so you can't reason about the values in this way</p>



<a name="219915324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915324">(Dec 14 2020 at 23:06)</a>:</h4>
<p>you might be able to use something more constrained than UB but not by much</p>



<a name="219915455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915455">(Dec 14 2020 at 23:08)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219915299">said</a>:</p>
<blockquote>
<p>so you can't reason about the values in this way</p>
</blockquote>
<p>I think I'm a little confused by what you mean by "you can't reason about the values". You <em>can</em>, you just might be wrong.</p>



<a name="219915664"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915664" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915664">(Dec 14 2020 at 23:10)</a>:</h4>
<p>I guess what I'm trying to figure out is what property you <em>do</em> expect to hold when there is a data race (which is what this is). Because it seems like this would more or less break all the compiler's assumptions</p>



<a name="219915704"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915704" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915704">(Dec 14 2020 at 23:11)</a>:</h4>
<p>and I have no idea what you can say about the result other than "it looks kind of like the output of a compiler"</p>



<a name="219915745"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915745" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915745">(Dec 14 2020 at 23:11)</a>:</h4>
<p>Thinking about it, let me try stating it in a slightly different way, which I <em>think</em> might be closing in on the distinction I'm trying to make:<br>
You're allowed to write through a pointer, and potentially overwrite some other value. That, in itself, shouldn't inherently be UB, because there are legitimate reasons to do so. You're also allowed to rely on the consistency of a value you're reading from a local variable. It's the <em>combination</em> of doing both of those things <em>on the same location</em> that leads to UB. Typically, the former gets defined as UB, because that's easier than saying the combination of the two is UB.</p>



<a name="219915856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915856">(Dec 14 2020 at 23:13)</a>:</h4>
<p>(This is meant to be an example of two interacting requirements, not the only two interacting requirements.)</p>



<a name="219915887"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915887" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915887">(Dec 14 2020 at 23:13)</a>:</h4>
<p>well, that's a conjunction of an action and an invariant, so the action alone has to be UB</p>



<a name="219915972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219915972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219915972">(Dec 14 2020 at 23:14)</a>:</h4>
<p>Can you define "action" and "invariant" here, because that sounds like you're stating a property that seems self-evident to you and it isn't obvious to me.</p>



<a name="219916128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916128">(Dec 14 2020 at 23:15)</a>:</h4>
<p>Action meaning operation with operational semantics (i.e. writing to memory modifies the abstract machine state), and invariant meaning a property that the compiler expects to hold across states (in this case the value of a piece of memory in a local variable). An invariant can't itself cause UB because it doesn't <em>do</em> anything, it just is a property that holds</p>



<a name="219916257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916257">(Dec 14 2020 at 23:17)</a>:</h4>
<p>Maybe you can weaken it to say that writing through a pointer is okay unless you happen to overwrite data that the compiler is relying on, but that probably encompasses all allocated memory and stack, so you are limited to unmapped regions and MMIO regions and such (which doesn't seem so bad)</p>



<a name="219916443"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916443" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916443">(Dec 14 2020 at 23:19)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219916257">said</a>:</p>
<blockquote>
<p>Maybe you can weaken it to say that writing through a pointer is okay unless you happen to overwrite data that the compiler is relying on, but that probably encompasses all allocated memory and stack, so you are limited to unmapped regions and MMIO regions and such (which doesn't seem so bad)</p>
</blockquote>
<p>That's part of it. It definitely <em>shouldn't</em> be UB to write through a pointer to something that other parts of the program reference via either a volatile pointer or a similar mechanism with load-once semantics, even if the write is unsynchronized (or generated by hardware or device or similar).</p>



<a name="219916612"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916612" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916612">(Dec 14 2020 at 23:21)</a>:</h4>
<p>I think as long as you have the concept of "volatile memory" and not just volatile access then that can be done; the abstract machine just relinquishes control on that region of memory and makes no promises about anything that comes out</p>



<a name="219916629"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916629" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916629">(Dec 14 2020 at 23:21)</a>:</h4>
<p>/me shakes his head there.</p>



<a name="219916678"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916678" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916678">(Dec 14 2020 at 23:21)</a>:</h4>
<p>but if you volatile access memory that is owned by some other place in the code then expect to crash and burn</p>



<a name="219916740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916740">(Dec 14 2020 at 23:22)</a>:</h4>
<p>In practice, even though C's use of <code>volatile</code> is in the context of a "volatile pointer", practical code tends to use it in the form of a "volatile access", and a "volatile pointer" is just "a pointer through which all accesses are volatile".</p>



<a name="219916780"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916780" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916780">(Dec 14 2020 at 23:23)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219916678">said</a>:</p>
<blockquote>
<p>but if you volatile access memory that is owned by some other place in the code then expect to crash and burn</p>
</blockquote>
<p>There are other cases. Consider, for instance, that you might use non-volatile operations on something before it becomes shared, and only start using volatile operations once you know it to be shared.</p>



<a name="219916823"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916823" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916823">(Dec 14 2020 at 23:23)</a>:</h4>
<p>Don't they say not to use volatile for concurrency?</p>



<a name="219916941"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916941" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916941">(Dec 14 2020 at 23:24)</a>:</h4>
<p>I think that such an operation needs to come with an explicit transfer of control from the rust AM to the volatile memory region</p>



<a name="219916957"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219916957" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219916957">(Dec 14 2020 at 23:24)</a>:</h4>
<p>Volatile is critical in non-blocking concurrency (as well as the concurrency between drivers and hardware, and other such things). The advice I've seen is more "volatile doesn't make your concurrency correct, it just allows you to carefully write correct code".</p>



<a name="219917010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917010">(Dec 14 2020 at 23:25)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219916941">said</a>:</p>
<blockquote>
<p>I think that such an operation needs to come with an explicit transfer of control from the rust AM to the volatile memory region</p>
</blockquote>
<p>Hardware is not written in the rust abstract machine, so I'm not sure what this would mean.</p>



<a name="219917107"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917107" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917107">(Dec 14 2020 at 23:26)</a>:</h4>
<p>You have to signal to rust that it doesn't own the memory anymore. It would be some hardware no op that is like a drop from rust's POV</p>



<a name="219917189"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917189" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917189">(Dec 14 2020 at 23:27)</a>:</h4>
<p>Ah, "ownership", not "control". I was assuming that the memory was accessed through a pointer the whole time, not via something that looks like ownership from Rust's perspective, yes.</p>



<a name="219917195"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917195" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917195">(Dec 14 2020 at 23:27)</a>:</h4>
<p>Otherwise, it could hold on to some non-volatile pointers into the region, access it without volatile because why not, mess up your MMIO, and then wonder why the value isn't still what it expected</p>



<a name="219917311"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917311" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917311">(Dec 14 2020 at 23:28)</a>:</h4>
<p>I'm suggesting that this is allowed without UB:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">use_non_volatile_ops</span><span class="p">(</span><span class="n">raw_ptr</span><span class="p">);</span><span class="w"></span>
<span class="n">bring_up_other_cpus</span><span class="p">();</span><span class="w"></span>
<span class="n">use_volatile_ops</span><span class="p">(</span><span class="n">raw_ptr</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="219917368"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917368" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917368">(Dec 14 2020 at 23:29)</a>:</h4>
<p>Or, for that matter:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">use_non_volatile_ops</span><span class="p">(</span><span class="n">raw_ptr</span><span class="p">);</span><span class="w"></span>
<span class="n">bring_up_device</span><span class="p">();</span><span class="w"></span>
<span class="n">use_volatile_ops</span><span class="p">(</span><span class="n">raw_ptr</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="219917536"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917536" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917536">(Dec 14 2020 at 23:31)</a>:</h4>
<p>(Separately, it's worth considering how that could be done safely without unsafe code or raw pointers, but at a minimum, <em>that</em> needs to be allowed with raw pointers and <code>unsafe</code>.)</p>



<a name="219917649"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917649" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917649">(Dec 14 2020 at 23:32)</a>:</h4>
<p>is it UB to access that memory as non-volatile in the <code>use_volatile_ops</code> section?</p>



<a name="219917761"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917761" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917761">(Dec 14 2020 at 23:33)</a>:</h4>
<p>Reasonable question. If it is, that would require very careful definition.</p>
<p>It should absolutely be possible to, for instance, shut down concurrent accesses and then start using non-volatile accesses again.</p>



<a name="219917852"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917852" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917852">(Dec 14 2020 at 23:34)</a>:</h4>
<p>that's why I think there should be explicit allocation/deallocation required to delimit the volatile section</p>



<a name="219917895"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917895" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917895">(Dec 14 2020 at 23:35)</a>:</h4>
<p>Do you mean "semantically" or "as an operation known to the Rust abstract machine"? The former seems fine. The latter not so much.</p>



<a name="219917916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917916">(Dec 14 2020 at 23:35)</a>:</h4>
<p>I'm not sure I see the difference</p>



<a name="219917942"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219917942" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219917942">(Dec 14 2020 at 23:35)</a>:</h4>
<p>it needs to be known to the RAM so that compiler optimizations respect it</p>



<a name="219918082"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918082" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918082">(Dec 14 2020 at 23:37)</a>:</h4>
<p>For instance, something like <code>lock_device_buffer(); use_non_volatile_ops_again(raw_ptr); unlock_device_buffer();</code>, where locking the device might involve setting a flag in the hardware to prevent it from making your accesses to <code>raw_ptr</code> inconsistent.</p>



<a name="219918114"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918114" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918114">(Dec 14 2020 at 23:37)</a>:</h4>
<p>Semantically, you are indeed delimiting your types of operations with those calls.</p>



<a name="219918142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918142">(Dec 14 2020 at 23:37)</a>:</h4>
<p>The Rust abstract machine has no idea what <code>bring_up_device()</code> does, though.</p>



<a name="219918193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918193">(Dec 14 2020 at 23:38)</a>:</h4>
<p>it would make sense for those operations to also let the compiler know so that it doesn't do something bad</p>



<a name="219918244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918244">(Dec 14 2020 at 23:39)</a>:</h4>
<p>In a sense, this is what <code>read_volatile</code> itself does - it's as if you have a little volatile section and do your read inside that</p>



<a name="219918272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918272">(Dec 14 2020 at 23:39)</a>:</h4>
<p>Well, if every volatile operation constitutes the kind of delineation you're asking for, then this is certainly trivial to satisfy. :)</p>



<a name="219918351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918351">(Dec 14 2020 at 23:40)</a>:</h4>
<p>but considering the way the rust memory model works it seems like a region/lifetime based approach is more accurate</p>



<a name="219918383"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918383" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918383">(Dec 14 2020 at 23:40)</a>:</h4>
<p>If we're trying to define this in <em>safe</em> code I absolutely agree.</p>



<a name="219918417"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918417" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918417">(Dec 14 2020 at 23:41)</a>:</h4>
<p>For <code>unsafe</code> code, I would hope that isn't necessary.</p>



<a name="219918438"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918438" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918438">(Dec 14 2020 at 23:41)</a>:</h4>
<p>well I don't think there is an essential difference between those. One just gets tool support</p>



<a name="219918507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918507">(Dec 14 2020 at 23:42)</a>:</h4>
<p>AFAICT, <code>unsafe</code> code doesn't typically have to <em>tell</em> the Rust compiler such things, it just does things, and then the compiler assumes whatever it did was acceptable.</p>



<a name="219918542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918542">(Dec 14 2020 at 23:42)</a>:</h4>
<p>well, <code>read</code>/<code>read_volatile</code> wouldn't exist if that were enough</p>



<a name="219918568"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918568" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918568">(Dec 14 2020 at 23:43)</a>:</h4>
<p>No, I agree that <code>read_volatile</code> is necessary. I'm just not clear on why you don't think it's sufficient, as well.</p>



<a name="219918634"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219918634" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219918634">(Dec 14 2020 at 23:43)</a>:</h4>
<p>Anything <em>beyond</em> <code>read_volatile</code> would be an abstraction to help people more easily write correct code; you don't <em>need</em> that abstraction to write correct code.</p>



<a name="219919128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919128">(Dec 14 2020 at 23:48)</a>:</h4>
<p>I don't expect the underlying semantics of <code>read_volatile</code> in the Rust abstract machine to be "start some region, read a thing, stop some region". I expect the underlying semantics to be a single "load once" semantic operation, which prevents the abstract machine from doing anything like "oh, I can just load that from memory again" that it could normally do with pointer loads.</p>



<a name="219919245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919245">(Dec 14 2020 at 23:50)</a>:</h4>
<blockquote>
<p>which prevents the abstract machine from doing anything like "oh, I can just load that from memory again" that it could normally do with pointer loads</p>
</blockquote>
<p>Why wouldn't it, if it's just regular memory? You might argue that if it does so it will not get the same answer, but I don't see how you disallow performing the read in the first place unless it's considered off limits in some way</p>



<a name="219919304"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919304" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919304">(Dec 14 2020 at 23:50)</a>:</h4>
<blockquote>
<p>I expect the underlying semantics to be a single "load once" semantic operation</p>
</blockquote>



<a name="219919312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919312">(Dec 14 2020 at 23:50)</a>:</h4>
<p>Because it was told not to.</p>



<a name="219919349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919349">(Dec 14 2020 at 23:51)</a>:</h4>
<p>that is, <code>let x = p.read_volatile();</code> can be "optimized" to <code>let x = p.read_volatile(); let y = p.read();</code></p>



<a name="219919359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919359">(Dec 14 2020 at 23:51)</a>:</h4>
<p>which would be bad</p>



<a name="219919381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919381">(Dec 14 2020 at 23:51)</a>:</h4>
<p>I'm assuming you meant for the former code to have some mention of <code>y</code>?</p>



<a name="219919385"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919385" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919385">(Dec 14 2020 at 23:51)</a>:</h4>
<p>no</p>



<a name="219919394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919394">(Dec 14 2020 at 23:51)</a>:</h4>
<p>Then what is <code>y</code>?</p>



<a name="219919398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919398">(Dec 14 2020 at 23:51)</a>:</h4>
<p>it's just a plain invented read</p>



<a name="219919460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919460">(Dec 14 2020 at 23:52)</a>:</h4>
<p>Why is the compiler inventing a read it wasn't told to perform, when it was just told "load once from this address"?</p>



<a name="219919461"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919461" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919461">(Dec 14 2020 at 23:52)</a>:</h4>
<p>if p is a raw pointer that seems not allowed</p>



<a name="219919486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919486">(Dec 14 2020 at 23:52)</a>:</h4>
<p>does the load not imply that <code>p</code> is dereferenceable?</p>



<a name="219919498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919498">(Dec 14 2020 at 23:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219916957">said</a>:</p>
<blockquote>
<p>Volatile is critical in non-blocking concurrency</p>
</blockquote>
<p>I mean, you can use it for that, like Linux does, but in general you can accomplish the same thing in a more portable way using atomics.</p>



<a name="219919531"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919531" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919531">(Dec 14 2020 at 23:53)</a>:</h4>
<p>but y could be reordered before/after x if it already existed by my understanding</p>



<a name="219919532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919532">(Dec 14 2020 at 23:53)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> For "volatile", feel free to read that as "something like volatile that provides appropriate load-once and store-once operations".</p>



<a name="219919561"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919561" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919561">(Dec 14 2020 at 23:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919486">said</a>:</p>
<blockquote>
<p>does the load not imply that <code>p</code> is dereferenceable?</p>
</blockquote>
<p>It implies "load once from p".</p>



<a name="219919567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919567">(Dec 14 2020 at 23:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919486">said</a>:</p>
<blockquote>
<p>does the load not imply that <code>p</code> is dereferenceable?</p>
</blockquote>
<p>I don't think a <em>volatile</em> load implies that <code>p</code> is dereferenceable.</p>



<a name="219919648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919648">(Dec 14 2020 at 23:54)</a>:</h4>
<p>so <code>p.read(); p.volatile_read();</code> ~&gt; <code>p.read(); p.volatile_read(); p.read();</code> then</p>



<a name="219919653"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919653" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919653">(Dec 14 2020 at 23:54)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919567">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919486">said</a>:</p>
<blockquote>
<p>does the load not imply that <code>p</code> is dereferenceable?</p>
</blockquote>
<p>I don't think a <em>volatile</em> load implies that <code>p</code> is dereferenceable.</p>
</blockquote>
<p>Especially since, in MMIO, a read may actually have side effects. So you <em>definitely</em> can't invent a read that wasn't there.</p>



<a name="219919673"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919673" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919673">(Dec 14 2020 at 23:54)</a>:</h4>
<p>That's the point I'm trying to make</p>



<a name="219919689"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919689" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919689">(Dec 14 2020 at 23:55)</a>:</h4>
<p>If p is a raw pointer you definitely can't manufacture reads</p>



<a name="219919716"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919716" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919716">(Dec 14 2020 at 23:55)</a>:</h4>
<p>If it's a reference, you probably shouldn't be doing volatile ops on it</p>



<a name="219919768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919768">(Dec 14 2020 at 23:55)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> In the interests of trying to interpret charitably rather than adversarially: are you trying to get at a case where the compiler reorders an existing non-volatile operation across a volatile operation?</p>



<a name="219919830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919830">(Dec 14 2020 at 23:56)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919648">said</a>:</p>
<blockquote>
<p>so <code>p.read(); p.volatile_read();</code> ~&gt; <code>p.read(); p.volatile_read(); p.read();</code> then</p>
</blockquote>
<p>This is still dubious since <code>p.volatile_read()</code> might deallocate <code>p</code>.</p>



<a name="219919852"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919852" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919852">(Dec 14 2020 at 23:56)</a>:</h4>
<p>I'm trying to show why the relevant invariant the RAM needs is a region based thing, not a single operation</p>



<a name="219919904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219919904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219919904">(Dec 14 2020 at 23:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919852">said</a>:</p>
<blockquote>
<p>I'm trying to show why the relevant invariant the RAM needs is a region based thing, not a single operation</p>
</blockquote>
<p>I still don't think it's a region. It's a single operation, that also has some ordering-barrier semantics. This gets into semantics of concurrency and barriers, and "what kind of a barrier does a volatile read/write imply".</p>



<a name="219920027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920027">(Dec 14 2020 at 23:58)</a>:</h4>
<p>Agreed.  But the barrier is limited to other accesses /to the same pointer/.</p>



<a name="219920072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920072">(Dec 14 2020 at 23:59)</a>:</h4>
<p>Otherwise reordering is allowed.</p>



<a name="219920080"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920080" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920080">(Dec 14 2020 at 23:59)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> I'd say "through the same pointer", but yes, in the absence of some other stronger barrier I think that might potentially be reasonable semantics.</p>



<a name="219920118"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920118" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920118">(Dec 14 2020 at 23:59)</a>:</h4>
<p>Also, the barrier would cover "other accesses to the same pointer whether volatile or not" as well as "volatile accesses to any pointer".</p>



<a name="219920133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920133">(Dec 14 2020 at 23:59)</a>:</h4>
<p>Right.</p>



<a name="219920142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920142">(Dec 14 2020 at 23:59)</a>:</h4>
<p>If I do <code>p1.read_volatile(); p2.read_volatile()</code>, the compiler is <em>not</em> allowed to reorder those either.</p>



<a name="219920274"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920274" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920274">(Dec 15 2020 at 00:00)</a>:</h4>
<p>Is it? I always thought the compiler was free to reorder volatile and non-volatile operations</p>



<a name="219920292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920292">(Dec 15 2020 at 00:00)</a>:</h4>
<p>Just not two volatile ops</p>



<a name="219920494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920494">(Dec 15 2020 at 00:03)</a>:</h4>
<p>(Aside: sometimes I wonder if it would help to have a <code>require_state_representable_on_concrete_machine_at_this_point()</code> operation, possibly with annotations for specific exceptions to that "as-if concrete machine" representation. That'd be a concrete equivalent to the fabled <code>barrier()</code> operation that some C code uses.)</p>



<a name="219920527"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920527" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920527">(Dec 15 2020 at 00:03)</a>:</h4>
<p>That exists, it's called <code>asm!("")</code> :)</p>



<a name="219920567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920567">(Dec 15 2020 at 00:03)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> It exists in C. I don't yet know if the Rust compiler agrees with you on that point. There's been discussion about using <code>asm!</code> for compiler barriers, and thus far, those of us advocating for <code>asm!</code> have carefully stayed out of that to avoid having potential roadblocks thrown up that might stymie <code>asm!</code>.</p>



<a name="219920658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920658">(Dec 15 2020 at 00:04)</a>:</h4>
<p><span class="user-mention silent" data-user-id="116122">simulacrum</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219920274">said</a>:</p>
<blockquote>
<p>Is it? I always thought the compiler was free to reorder volatile and non-volatile operations</p>
</blockquote>
<p>In general it is free to do so.  But even two non-volatile operations can't be reordered with each other if they're accessing the same memory, so at least in practice compilers give the same courtesy to reordering non-volatile with volatile.</p>



<a name="219920766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920766">(Dec 15 2020 at 00:05)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> (Except on Alpha. Let us never speak of Alpha.)</p>



<a name="219920774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920774">(Dec 15 2020 at 00:05)</a>:</h4>
<p>I mean by the compiler.</p>



<a name="219920861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920861">(Dec 15 2020 at 00:06)</a>:</h4>
<p>Sorry, reflex from past trauma. ;)</p>



<a name="219920923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920923">(Dec 15 2020 at 00:07)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> Of course, in practice you can't ask for <em>all</em> state to be representable on the concrete machine; if there's some outer function frame, for instance, and it has some pointer variable where the optimized code made some assumption about provenance, you can't magically make that go away.</p>



<a name="219920951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219920951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219920951">(Dec 15 2020 at 00:08)</a>:</h4>
<p>Two non-volatile reads from the same memory can be merged by the compiler or reordered? I don't see why not, at least</p>



<a name="219921000"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921000" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921000">(Dec 15 2020 at 00:08)</a>:</h4>
<p>Good point, I was thinking about writes</p>



<a name="219921010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921010">(Dec 15 2020 at 00:08)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219920658">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="116122">simulacrum</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219920274">said</a>:</p>
<blockquote>
<p>Is it? I always thought the compiler was free to reorder volatile and non-volatile operations</p>
</blockquote>
<p>In general it is free to do so.  But even two non-volatile operations can't be reordered with each other if they're accessing the same memory, so at least in practice compilers give the same courtesy to reordering non-volatile with volatile.</p>
</blockquote>
<p>I'm not entirely sure that's true. I <em>think</em> the compiler may be allowed to perform optimizations that are the equivalent to reordering non-volatile operations on the same memory.</p>



<a name="219921061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921061">(Dec 15 2020 at 00:09)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219920923">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> Of course, in practice you can't ask for <em>all</em> state to be representable on the concrete machine; if there's some outer function frame, for instance, and it has some pointer variable where the optimized code made some assumption about provenance, you can't magically make that go away.</p>
</blockquote>
<p>In C at least, calling an external function can act as such a barrier, and because of that, you <em>can</em> expect the compiler to not make such assumptions across calls to you.</p>



<a name="219921154"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921154" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921154">(Dec 15 2020 at 00:10)</a>:</h4>
<p>Sure, but if you say, e.g., <code>int x = 0; call_external_function(); return x;</code>, the compiler is still allowed to optimize <code>return x</code> to <code>return 0</code>.</p>



<a name="219921170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921170">(Dec 15 2020 at 00:10)</a>:</h4>
<p>Also, the as-if rule becomes very relevant here. The compiler need not make some bit of state machine-representable if you have no access to that state.</p>



<a name="219921174"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921174" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921174">(Dec 15 2020 at 00:10)</a>:</h4>
<p>Yes, that, exactly.</p>



<a name="219921189"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921189" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921189">(Dec 15 2020 at 00:10)</a>:</h4>
<p>That said, I think in practice there are a <em>lot</em> of broken assumptions about what exactly a compiler barrier does, and it just so happens that the ways in which programmers use such barriers are very focused on specific cases that happen to work.</p>



<a name="219921253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921253">(Dec 15 2020 at 00:11)</a>:</h4>
<p>(I didn't mean to introduce a tangent with that aside. Let's go back to volatile reads, rather than general compiler barriers.)</p>



<a name="219921255"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921255" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921255">(Dec 15 2020 at 00:11)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219921000">said</a>:</p>
<blockquote>
<p>Good point, I was thinking about writes</p>
</blockquote>
<p>Though it doesn't actually matter.  If at least one of the reads is non-volatile, then this must be regular memory not MMIO, <em>and</em> there can't be any concurrent writes to the same memory because that would be a UB data race.  So reordering the non-volatile and volatile read won't make an observable difference.</p>



<a name="219921370"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921370" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921370">(Dec 15 2020 at 00:13)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> Earlier in the same conversation, I was observing that it should be possible to switch from non-volatile to volatile or vice versa, if you only do non-volatile operations when you know there can be no concurrent operations (e.g. a device is not active, the system has not brought up other CPUs, etc).</p>



<a name="219921384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921384">(Dec 15 2020 at 00:13)</a>:</h4>
<p>That's part of the motivation for talking about "volatile operations" rather than "volatile memory" or "volatile pointers".</p>



<a name="219921467"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921467" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921467">(Dec 15 2020 at 00:14)</a>:</h4>
<p>I think you need a barrier of some kind in between (wrt to this reordering I'm talking about)</p>



<a name="219921517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921517">(Dec 15 2020 at 00:14)</a>:</h4>
<p>I'm hoping that <code>read_volatile</code> is such a barrier.</p>



<a name="219921533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921533">(Dec 15 2020 at 00:15)</a>:</h4>
<p>By the way, even though I believe this is in some sense "uninteresting" because you should be using atomics instead, a very similar concept applies to mixed atomic and non-atomic accesses.</p>



<a name="219921562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921562">(Dec 15 2020 at 00:15)</a>:</h4>
<p>so the analogue would be <code>volatile_fence()</code> then?</p>



<a name="219921568"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921568" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921568">(Dec 15 2020 at 00:15)</a>:</h4>
<p>My point is that then it's not just a volatile operation - it's more than that</p>



<a name="219921585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921585">(Dec 15 2020 at 00:15)</a>:</h4>
<p>(that may be reasonable)</p>



<a name="219921586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921586">(Dec 15 2020 at 00:15)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219921562">said</a>:</p>
<blockquote>
<p>so the analogue would be <code>volatile_fence()</code> then?</p>
</blockquote>
<p>What is <code>volatile_fence</code>?</p>



<a name="219921658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921658">(Dec 15 2020 at 00:16)</a>:</h4>
<p>(Trying not to make assumptions.)</p>



<a name="219921698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921698">(Dec 15 2020 at 00:16)</a>:</h4>
<p>In the atomics case, it's possible to mix non-atomic and atomic accesses with entirely safe code, since you can do a non-atomic access to e.g. an <code>AtomicI8</code> either by copying the entire <code>AtomicI8</code> object or by using <code>get_mut</code>.</p>



<a name="219921706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921706">(Dec 15 2020 at 00:17)</a>:</h4>
<p>Not really sure, but I suppose it could play the role of starting/stopping a volatile region as I mentioned earlier, with the more local meaning of blocking reordering of a volatile read wrt a non-volatile read</p>



<a name="219921769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921769">(Dec 15 2020 at 00:17)</a>:</h4>
<p>In contrast, in C++, you're not really allowed to do that because <code>atomic&lt;char&gt;</code> and <code>char</code> are not guaranteed to have the same representation.</p>



<a name="219921777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921777">(Dec 15 2020 at 00:18)</a>:</h4>
<p>Not that people don't do it anyway.</p>



<a name="219921833"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921833" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921833">(Dec 15 2020 at 00:18)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> To confirm, by "non-atomic", you don't mean "relaxed"?</p>



<a name="219921835"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921835" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921835">(Dec 15 2020 at 00:18)</a>:</h4>
<p><span class="user-mention" data-user-id="198590">@comex</span> Atomic types in Rust aren't copy so no, you can't copy the whole object - but get_mut you can.</p>



<a name="219921846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921846">(Dec 15 2020 at 00:18)</a>:</h4>
<p>You mean "actually bypassing the use of atomic operations"?</p>



<a name="219921849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921849">(Dec 15 2020 at 00:18)</a>:</h4>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> oh, move then</p>



<a name="219921857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921857">(Dec 15 2020 at 00:18)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> yes, I mean bypassing.</p>



<a name="219921920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921920">(Dec 15 2020 at 00:19)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> In what case does reordering of a volatile read wrt a non-volatile read of the same address affect observable behavior, that is not already UB or disallowed for another reason?</p>



<a name="219921950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219921950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219921950">(Dec 15 2020 at 00:19)</a>:</h4>
<p>Right, but if you can move you have ownership h so it's not shared, and then no (non-relaxed?) atomic op would matter for the same thread when being reordered afaik, so as-if rule permits it in that case I think.</p>



<a name="219922029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922029">(Dec 15 2020 at 00:20)</a>:</h4>
<p>eh, I'm not good on atomic fences either. Just substitute the sort of operations you would use an atomic fence for</p>



<a name="219922108"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922108" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922108">(Dec 15 2020 at 00:21)</a>:</h4>
<p><span class="user-mention" data-user-id="116122">@simulacrum</span> Yeah, sorry if I'm being unclear, performing any non-atomic ops while other threads are accessing the same memory (whether atomically or not) is definitely an UB data race, unless all accesses are reads.</p>



<a name="219922282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922282">(Dec 15 2020 at 00:23)</a>:</h4>
<p>wait so that's a soundness hole?</p>



<a name="219922304"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922304" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922304">(Dec 15 2020 at 00:23)</a>:</h4>
<p>No, you can't do that in safe code.</p>



<a name="219922322"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922322" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922322">(Dec 15 2020 at 00:23)</a>:</h4>
<p>you can move an atomic in safe code</p>



<a name="219922375"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922375" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922375">(Dec 15 2020 at 00:24)</a>:</h4>
<p>and you can be writing that same atomic from another thread</p>



<a name="219922388"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922388" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922388">(Dec 15 2020 at 00:24)</a>:</h4>
<p>You can't, because if another thread has access then you wouldn't be allowed to move in safe code.</p>



<a name="219922408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922408">(Dec 15 2020 at 00:24)</a>:</h4>
<p>But you can do those things at different times.  That's all I'm saying.</p>



<a name="219922427"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922427" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922427">(Dec 15 2020 at 00:24)</a>:</h4>
<p>aha</p>



<a name="219922488"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922488" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922488">(Dec 15 2020 at 00:25)</a>:</h4>
<p>Memory has to be able to transition between 'exclusive to one thread, allows non-atomic accesses' and 'shared, requires atomic accesses'.  And I think a similar concept should apply to volatile.</p>



<a name="219922649"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922649" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922649">(Dec 15 2020 at 00:27)</a>:</h4>
<p>So, it seems like we're narrowing in on the semantics of volatile accesses, and of the interaction between volatile and non-volatile accesses through the same pointer.</p>



<a name="219922758"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922758" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922758">(Dec 15 2020 at 00:28)</a>:</h4>
<blockquote>
<p>so <code>p.read(); p.volatile_read();</code> ~&gt; <code>p.read(); p.volatile_read(); p.read();</code> then</p>
</blockquote>
<p>That's valid, as is reordering <code>p.read()</code> and <code>p.volatile_read()</code>, because volatile accesses are only guaranteed to be in-sequence relative to other volatile accesses, assuming rust follows the C++11 memory model.</p>



<a name="219922783"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922783" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922783">(Dec 15 2020 at 00:28)</a>:</h4>
<p><span class="user-mention" data-user-id="257758">@Connor Horman</span> Are you interpreting "volatile" as "atomic"?</p>



<a name="219922790"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922790" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922790">(Dec 15 2020 at 00:28)</a>:</h4>
<p>Nope. That's how volatile is defined.</p>



<a name="219922825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219922825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219922825">(Dec 15 2020 at 00:29)</a>:</h4>
<p>"Accesses through volatile glvalues may not be reordered relative to any other access through a volatile glvalue"</p>



<a name="219923024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923024">(Dec 15 2020 at 00:31)</a>:</h4>
<p>Yeah I agree that this transfer exists without an obvious fence, though from a high level perspective it's "lifetime of last shared reference ended" or something along those lines. With volatile it seems harder, because you're probably just using volatile reads on raw pointers - no lifetimes involved</p>



<a name="219923058"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923058" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923058">(Dec 15 2020 at 00:31)</a>:</h4>
<p>If we interpret read_volatile and write_volatile as being the same as a read or write through an lvalue of type <code>volatile T</code> and <code>const volatile T</code> respectively, the order of read_volatile and write_volatile operations is guaranteed.</p>



<a name="219923085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923085">(Dec 15 2020 at 00:31)</a>:</h4>
<p>But surrounding reads from the same can be reordered, unless the volatile op is a write.</p>



<a name="219923148"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923148" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923148">(Dec 15 2020 at 00:32)</a>:</h4>
<p><span class="user-mention" data-user-id="257758">@Connor Horman</span> I think that's wrong, you cannot synthesize reads of raw pointers - you can reorder but not create</p>



<a name="219923170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923170">(Dec 15 2020 at 00:32)</a>:</h4>
<p>You cannot synthesize them no.</p>



<a name="219923223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923223">(Dec 15 2020 at 00:32)</a>:</h4>
<p>But I was noting they can be reordered, even with an intervening volatile read.</p>



<a name="219923225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923225">(Dec 15 2020 at 00:32)</a>:</h4>
<p>Reordering would be sufficient to cause havoc, if the sequence <code>p.read(); start_concurrency(); p.read_volatile()</code> can have the read reordered.</p>



<a name="219923253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923253">(Dec 15 2020 at 00:33)</a>:</h4>
<p>Right, I agree with reordering being enough to cause problems</p>



<a name="219923272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923272">(Dec 15 2020 at 00:33)</a>:</h4>
<p><code>start_concurrency()</code> can prevent that by performing a fence operation.</p>



<a name="219923306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923306">(Dec 15 2020 at 00:33)</a>:</h4>
<p>(In which case, the fence prevents the reordering)</p>



<a name="219923373"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923373" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923373">(Dec 15 2020 at 00:34)</a>:</h4>
<p>I know what a fence operation means in the context of GCC or clang. What kind of fence do you mean in the context of Rust <code>read_volatile</code>?</p>



<a name="219923455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923455">(Dec 15 2020 at 00:35)</a>:</h4>
<p>compiler_fence presumably?</p>



<a name="219923483"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923483" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923483">(Dec 15 2020 at 00:35)</a>:</h4>
<p>Either one, depending on hardware guarantees available.</p>



<a name="219923499"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923499" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923499">(Dec 15 2020 at 00:35)</a>:</h4>
<p>Oh, we <em>do</em> have <code>compiler_fence</code>.</p>



<a name="219923559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923559">(Dec 15 2020 at 00:36)</a>:</h4>
<p>At least Release if the p.read_volatile being moved before it is ok, otherwise, AcqRel or SeqCst is needed.</p>



<a name="219923566"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923566" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923566">(Dec 15 2020 at 00:36)</a>:</h4>
<p>With all the discussion about trying to emulate a compiler barrier in various ways, I hadn't seen that we actually <em>have</em> one.</p>



<a name="219923587"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923587" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923587">(Dec 15 2020 at 00:36)</a>:</h4>
<p><code>core::sync::atomic::compiler_fence</code></p>



<a name="219923605"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923605" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923605">(Dec 15 2020 at 00:37)</a>:</h4>
<p>Yeah, found that when <span class="user-mention" data-user-id="116122">@simulacrum</span> mentioned it by name.</p>



<a name="219923667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923667">(Dec 15 2020 at 00:37)</a>:</h4>
<p>(Aside: insert grumbling about C/C++ using "acquire" and "release" semantics rather than "rmb"/"wmb" semantics.)</p>



<a name="219923730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923730">(Dec 15 2020 at 00:38)</a>:</h4>
<p>I thought it didn't work? I could be misremembering</p>



<a name="219923735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219923735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219923735">(Dec 15 2020 at 00:38)</a>:</h4>
<p>(It also has <code>core::sync::atomic::fence</code> which is at least as correct)</p>



<a name="219924573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219924573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219924573">(Dec 15 2020 at 00:46)</a>:</h4>
<p>So, given an underlying mechanism of <code>read_volatile</code>, <code>write_volatile</code>, and <code>compiler_fence</code>, I <em>think</em> it's possible to build a sound <code>Volatile&lt;T&gt;</code> (for word-sized-or-less, naturally-aligned types <code>T</code>, or alternatively <code>VolatileU32</code>/<code>VolatileU8</code>/<code>VolatileUsize</code>/etc).</p>



<a name="219924658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219924658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219924658">(Dec 15 2020 at 00:47)</a>:</h4>
<p>And, for that matter, a <code>VolatileMemory</code> abstraction for MMIO or shared memory.</p>



<a name="219924768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219924768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219924768">(Dec 15 2020 at 00:48)</a>:</h4>
<p>Assuming we need such an abstraction.</p>



<a name="219924854"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219924854" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219924854">(Dec 15 2020 at 00:49)</a>:</h4>
<p>(And assuming there's value in providing that abstraction rather than just relaxed atomics.)</p>



<a name="219925229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219925229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219925229">(Dec 15 2020 at 00:54)</a>:</h4>
<p>All that said, it doesn't seem <em>unreasonable</em> to potentially have a built-in concept of volatile ordering relative to non-volatile ordering, but it's probably livable to do without that and build it in a higher-level abstraction.</p>



<a name="219927153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219927153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cliff L. Biffle <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219927153">(Dec 15 2020 at 01:23)</a>:</h4>
<p>(Aside: yes, there is a value to that distinction vs relaxed atomics, because atomic operations are not well-defined on MMIO at the _architectural_ level on at least ARMv7-M. Anyway, this thread is fascinating, do carry on.)</p>



<a name="219934807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219934807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219934807">(Dec 15 2020 at 03:44)</a>:</h4>
<blockquote>
<p>others keep pushing for shipping something so we can get things into the hands of users.</p>
</blockquote>
<p>I am definitely in this camp <span aria-label="laughing" class="emoji emoji-1f606" role="img" title="laughing">:laughing:</span> I added so many hacks to stabilize intra-doc links <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<a name="219938102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219938102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Quy Nguyen <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219938102">(Dec 15 2020 at 04:55)</a>:</h4>
<p>Given that int-ptr casts already mark the memory as globally accessible, what further optimizations  are prevented by not making them a no-op in the abstract machine?</p>



<a name="219938164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219938164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219938164">(Dec 15 2020 at 04:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="371550">Cliff L. Biffle</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219927153">said</a>:</p>
<blockquote>
<p>(Aside: yes, there is a value to that distinction vs relaxed atomics, because atomic operations are not well-defined on MMIO at the _architectural_ level on at least ARMv7-M. Anyway, this thread is fascinating, do carry on.)</p>
</blockquote>
<p>Can you elaborate on that?</p>



<a name="219949170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219949170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219949170">(Dec 15 2020 at 08:34)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219889537">said</a>:</p>
<blockquote>
<p>My reaction to the C example is that signed overflow being UB was a historical artifact of the standard allowing non-two's-complement representations, and now that C2x mandates the two's complement representation, the standard <em>should</em> define signed overflow as wrapping just as it does for unsigned overflow.</p>
</blockquote>
<p>sure, but the example is not really specific to overflow. you can replace it by out-of-bounds pointer arithmetic or any other number of things where C says "this is immediate UB" and LLVM instead says "this produces <code>poison</code>" -- the point is that sometimes a form of "delayed UB" is better for optimizations, and IRs have to carefully document what they do in each case. integer overflow is really just the simplest example to demonstrate this.</p>



<a name="219949383"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219949383" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219949383">(Dec 15 2020 at 08:37)</a>:</h4>
<p><span class="user-mention silent" data-user-id="198590">comex</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219892906">said</a>:</p>
<blockquote>
<p>So, suppose you don't have provenance.  The first question is whether you allow guessing pointers "out of thin air".  Suppose you have</p>
<div class="codehilite"><pre><span></span><code>int a = 0;
*(int *)0x1234 = 99;
return a;
</code></pre></div>
<p>and the compiler happens to store <code>a</code> on the stack at address <code>0x1234</code>.  Is this program well-defined?</p>
</blockquote>
<p>Allocation is non-deterministic, and the C def.n of UB says it is enough for UB to be possible for it to "taint" all the possible branches. At least that is a common interpretation of the "acausal / backwards-in-time" nature of UB in C.<br>
See <a href="https://people.mpi-sws.org/~jung/twinsem/twinsem.pdf">https://people.mpi-sws.org/~jung/twinsem/twinsem.pdf</a> for a formal argument based on this that prevents guessing out of thin air without relying on provenance. ;) These "twin allocations" are my contribution to that paper.</p>



<a name="219949595"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219949595" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219949595">(Dec 15 2020 at 08:40)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219897730">said</a>:</p>
<blockquote>
<p>in particular, I think it is important that a provenance, if you want to call it that, can exist separately from the value, travel along different control flow and get recombined later<br>
I'm pretty sure that this is impossible with LLVM style provenance</p>
</blockquote>
<p>I think it is very possible, we just need to add the right primitives for that.<br>
The tricky bit is making it so that you can actually compile these primitives to machine code though. ;)</p>



<a name="219950006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219950006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219950006">(Dec 15 2020 at 08:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219914245">said</a>:</p>
<blockquote>
<p>That doesn't mean it's UB; it means I might get inconsistent results depending on optimizations and similar.</p>
</blockquote>
<p>So what is even the notion of a "correct optimization" now if optimizations may change program behavior? How can we tell correct optimizations from broken ones? How can programmers perform arguments showing that their code will execute as intended when compiled by any correct compiler?<br>
I think my post demonstrates that saying "here's a list of optimizations you may perform, go wild" and calling that a spec is a very bad idea. Optimizations can "work together" to have very unexpected side-effects.</p>



<a name="219950241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219950241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219950241">(Dec 15 2020 at 08:49)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219916957">said</a>:</p>
<blockquote>
<p>Volatile is critical in non-blocking concurrency (as well as the concurrency between drivers and hardware, and other such things). The advice I've seen is more "volatile doesn't make your concurrency correct, it just allows you to carefully write correct code".</p>
</blockquote>
<p>for drivers&lt;-&gt;hardware (or non-cash-coherent concurrency in general), okay; but for non-blocking concurrency I disagree. the C++11 memory model is all about letting people write non-blocking fine-grained concurrent algorithms, so volatile is certainly not required/critical for that. AFAIK it is only still used by old pre-C++11 code (and the Linux kernel but Linux isn't written in C, it's written in GCC-C with a very loosely specified memory model so it's hard to say anything definite about it).<br>
EDIT: Ah looks like you included atomics in your notion of "volatile"... which is very confusing to me since the way I see it, the two serve very different purposes. atomics are about concurrency within the abstract machine; volatile are about memory-based interactions with the "outside world".</p>



<a name="219950584"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219950584" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219950584">(Dec 15 2020 at 08:54)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219919312">said</a>:</p>
<blockquote>
<p>Because it was told not to.</p>
</blockquote>
<p>(about duplicating volatile loads in the abstract machine)<br>
the tricky bit is figuring out how to tell it. ;) being able to reorder loads in the abstract machine is an easily proven <em>theorem</em>, you can't just say "I want that theorem not to be true", you have to find a way to set up the definitions such that indeed it is not true. we don't just get to state our wishes and then they magically become true. ;) The C standard does this a lot (specifically also for volatiles as quoted above), and this is one reason for why it is so ambiguous despite being so extensive.<br>
(specifically for volatile, I've seen various proposals for how to do this by making volatile accesses "observable" and thus the as-if rule says they may not be affected by optimizations, see <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/33#issuecomment-429112051">for example here</a>. but the problem arises in general with these abstract machine discussions -- I find it very hard to have constructive discussions unless someone makes a proposal for a concrete Abstract Machine definition, and then everyone can start analyzing its properties.)</p>



<a name="219951716"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219951716" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219951716">(Dec 15 2020 at 09:09)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219891110">said</a>:</p>
<blockquote>
<p>Going back to the blog post: along the same lines, I find it unfortunate that the third possibility is dismissed so strongly.</p>
</blockquote>
<p>the third possibility means giving up all reference-based alias analysis in Rust. it means giving up <code>restrict</code> in C. it means allowing both <code>offset</code> and <code>wrapping_offset</code> to cross object boundaries. basically it means that expect in very controlled circumstances, we have no chance of making any statement about the aliasing of any pointer. (<span class="user-mention" data-user-id="271719">@Mario Carneiro</span> says they have some ideas for how to avoid this inherent trade-off; I am excited at the thought of that and will remain skeptical until I see a more concrete proposal. ;)<br>
As far as I am concerned, the industry has dismissed this option decades ago. I see very little chance that LLVM, GCC, ICC, MSVC are going to make up their mind about this and stop doing optimizations that inherently rely on provenance. I assume cranelift also relies on provenance but don't know enough about it to be sure.</p>



<a name="219951826"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219951826" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219951826">(Dec 15 2020 at 09:11)</a>:</h4>
<p>So I wonder what is the goal of these discussions then. Is it to propose that Rust should adopt a no-provenance model of whatever kind (maybe along the lines of what <span class="user-mention" data-user-id="239881">@Josh Triplett</span> has in mind), and write a new compiler backend from scratch that implements this model? Or is the entire discussion here just musing about "what could have been" but we all agree, for better or worse, that we live in a world where provenance is a thing, there's no point denying that and we have to find a way to live with it?</p>



<a name="219951920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219951920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219951920">(Dec 15 2020 at 09:12)</a>:</h4>
<p>Cranelift doesn't have provenance at the moment. Memory operations are essentially considered volatile currently. The only exception is when you specify memflags like aligned, notrap (loading/storing will not cause a signal) or readonly (loaded value is constant within the current function): <a href="https://docs.rs/cranelift-codegen/0.66.0/cranelift_codegen/ir/struct.MemFlags.html">https://docs.rs/cranelift-codegen/0.66.0/cranelift_codegen/ir/struct.MemFlags.html</a></p>



<a name="219951941"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219951941" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219951941">(Dec 15 2020 at 09:12)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219951920">said</a>:</p>
<blockquote>
<p>Cranelift doesn't have provenance at the moment. Memory operations are essentially considered volatile currently. The only exception is when you specify memflags like aligned, notrap (loading/storing will not cause a signal) or readonly (loaded value is constant within the current function): <a href="https://docs.rs/cranelift-codegen/0.66.0/cranelift_codegen/ir/struct.MemFlags.html">https://docs.rs/cranelift-codegen/0.66.0/cranelift_codegen/ir/struct.MemFlags.html</a></p>
</blockquote>
<p>volatile is no no way contradicting with provenance</p>



<a name="219952008"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952008" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952008">(Dec 15 2020 at 09:13)</a>:</h4>
<p>I mean that in Cranelift memory operations will never be touched except for when memflags are used.</p>



<a name="219952056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952056">(Dec 15 2020 at 09:14)</a>:</h4>
<p>Cranelift barely has any UB at the moment.</p>



<a name="219952069"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952069" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952069">(Dec 15 2020 at 09:14)</a>:</h4>
<p>does craneleft have any rule like "memory accesses must be in-bounds of the allocation the pointer was originally created for" or "pointer arithmetic must not cross allocation boundaries"?</p>



<a name="219952111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952111">(Dec 15 2020 at 09:14)</a>:</h4>
<p>No, the only optimizations on memory optimizations it currently does are DCE, GVN and LICM.</p>



<a name="219952171"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952171" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952171">(Dec 15 2020 at 09:15)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> Will respond further when it isn't 1am. But I did want to express appreciation for your first point: regardless of the specific bit of C UB used to make the point, the explanation for how LLVM uses poison is the first time I've seen value in it. Thank you for that clear explanation.</p>



<a name="219952208"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952208" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952208">(Dec 15 2020 at 09:15)</a>:</h4>
<p><span class="user-mention" data-user-id="133247">@bjorn3</span>  LICM?</p>



<a name="219952256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952256">(Dec 15 2020 at 09:16)</a>:</h4>
<p>loop invariant code motion</p>



<a name="219952271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952271">(Dec 15 2020 at 09:16)</a>:</h4>
<p>ah</p>



<a name="219952290"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952290" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952290">(Dec 15 2020 at 09:16)</a>:</h4>
<p>and I guess memory accesses are not being considered loop invariant ever (except maybe for readonly accessible ones)?</p>



<a name="219952310"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952310" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952310">(Dec 15 2020 at 09:16)</a>:</h4>
<p>Also, I don't believe we'd have to give up on alias analysis completely. It would just require the compiler to prove more things rather than assuming them.</p>



<a name="219952376"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952376" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952376">(Dec 15 2020 at 09:17)</a>:</h4>
<p>(Plus, it's worth noting that we don't currently <em>have</em> LLVM noalias because bugs, so doing without it is certainly possible...)</p>



<a name="219952381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952381">(Dec 15 2020 at 09:17)</a>:</h4>
<p>The basic problem with having the compiler prove things is that it has to know things first</p>



<a name="219952398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952398">(Dec 15 2020 at 09:17)</a>:</h4>
<p>and it has to get that knowledge from somewhere</p>



<a name="219952404"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952404" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952404">(Dec 15 2020 at 09:18)</a>:</h4>
<p><a href="https://github.com/bytecodealliance/wasmtime/blob/fc4eeae8961c56d2307e4f9ed895f06d3ff43887/cranelift/codegen/src/licm.rs#L139-L158">https://github.com/bytecodealliance/wasmtime/blob/fc4eeae8961c56d2307e4f9ed895f06d3ff43887/cranelift/codegen/src/licm.rs#L139-L158</a></p>
<p>it requires notrap and readonly on loads</p>



<a name="219952476"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952476" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952476">(Dec 15 2020 at 09:18)</a>:</h4>
<p>The usual mechanism for conveying information to the compiler that it can use in proofs is through operations with UB</p>



<a name="219952477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952477">(Dec 15 2020 at 09:18)</a>:</h4>
<p><span class="user-mention" data-user-id="271719">@Mario Carneiro</span> I'm not suggesting it can't know things, I'm just suggesting reducing what it's worth to assume without proof.</p>



<a name="219952488"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952488" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952488">(Dec 15 2020 at 09:18)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219952310">said</a>:</p>
<blockquote>
<p>Also, I don't believe we'd have to give up on alias analysis completely. It would just require the compiler to prove more things rather than assuming them.</p>
</blockquote>
<p>those are the 'controlled circumstances' I talked about. but in what I think are the vast majority of cases, there's no way for the compiler to perform these proofs. this includes in particular everything enabled by Stacked Borrows, and likewise <code>restrict</code>, where the pointers are passed in as arguments and so there's no way to prove anything about them (and indeed there are counterexamples to the optimizations, so only a buggy compiler could ever produce a 'proof').</p>



<a name="219952559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952559">(Dec 15 2020 at 09:19)</a>:</h4>
<p>So, with restrict, the compiler is being <em>told</em> that it can make an assumption, so it's fine for it to do so.</p>



<a name="219952579"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952579" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952579">(Dec 15 2020 at 09:19)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219952559">said</a>:</p>
<blockquote>
<p>So, with restrict, the compiler is being <em>told</em> that it can make an assumption, so it's fine for it to do so.</p>
</blockquote>
<p>to formalize restrict you need to add provenance</p>



<a name="219952671"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952671" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952671">(Dec 15 2020 at 09:20)</a>:</h4>
<p><code>restrict</code> introduces a situation similar to the "one-past-the-end" that I used in the blog post, where two pointers can point to the same thing but may not be used interchangeably. IOW, there's something that distinguishes these pointers but it's not the address they point to.</p>



<a name="219952789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952789">(Dec 15 2020 at 09:21)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219952111">said</a>:</p>
<blockquote>
<p>No, the only optimizations on memory optimizations it currently does are DCE, GVN and LICM.</p>
</blockquote>
<p>as my blog post shows, GVN is already tricky. LLVM is performing GVN on pointers, including taking <code>if (p == q)</code> as introducing an equivalence that GVN may exploit, and that's wrong in the presence of provenance.<br>
but GVN can only enforce the absence of provenance, not its presence, so... yeah maybe cranelift currently truly does not have provenance. that'll be an interesting datapoint!</p>



<a name="219952900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952900">(Dec 15 2020 at 09:22)</a>:</h4>
<p>Cranelift doesn't even know about the concept of pointers. <code>load</code> and <code>store</code> just accept an pointer sized integer.</p>



<a name="219952948"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952948" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952948">(Dec 15 2020 at 09:23)</a>:</h4>
<p>well sure but that could just as well be caused by its designers ignoring provenance issues, as happened in LLVM and GCC ;)</p>



<a name="219952992"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219952992" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219952992">(Dec 15 2020 at 09:23)</a>:</h4>
<p>but this means that right now adding any provenance-based optimizations to cranelift would be wrong and could introduce miscompilations</p>



<a name="219953018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953018">(Dec 15 2020 at 09:23)</a>:</h4>
<p>(assuming its GVN exploits <code>if (i == j)</code>)</p>



<a name="219953109"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953109" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953109">(Dec 15 2020 at 09:24)</a>:</h4>
<p>WASM doesn't have UB or provenance, so Cranelift itself must not either. Any optimizations that require provenance would have to be layered on top of Cranelift.</p>



<a name="219953133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953133">(Dec 15 2020 at 09:24)</a>:</h4>
<p>For the specific case of off-the-end pointers, one optimization I notice you didn't mention: what about the compiler noticing that the values being compared come from different allocations, so it can optimize away the conditional entirely by assuming the condition is false?</p>



<a name="219953214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953214">(Dec 15 2020 at 09:25)</a>:</h4>
<p>(even if by a value representation they might be equal)</p>



<a name="219953216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953216">(Dec 15 2020 at 09:25)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> a different way to put this is to say that the provenance example in the blog post is <em>also</em> about the compiler being <em>told</em> that it can make the non-aliasing assumption. the assumption is just expressed somewhat clumsily by writing <code>p+1</code> vs <code>q</code> -- by using two different "base pointers" one implicitly says "treat these as <code>restrict</code>"</p>



<a name="219953265"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953265" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953265">(Dec 15 2020 at 09:25)</a>:</h4>
<p>making <code>restrict</code> more explicit changes nothing about the fundamental nature of provenance</p>



<a name="219953393"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953393" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953393">(Dec 15 2020 at 09:26)</a>:</h4>
<p>It would mean that a frontend can chose to not use provenance though and thus miss on certain optimizations.</p>



<a name="219953394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953394">(Dec 15 2020 at 09:26)</a>:</h4>
<p>Are you presenting that as a fundamental property of restrict, or just that compilers typically express restrict through provenance?</p>



<a name="219953408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953408">(Dec 15 2020 at 09:26)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953133">said</a>:</p>
<blockquote>
<p>For the specific case of off-the-end pointers, one optimization I notice you didn't mention: what about the compiler noticing that the values being compared come from different allocations, so it can optimize away the conditional entirely by assuming the condition is false?</p>
</blockquote>
<p>In C that would be incorrect; C says when comparing pointers, their underlying address must be compared.</p>



<a name="219953456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953456">(Dec 15 2020 at 09:27)</a>:</h4>
<p>C++ says the result is "indeterminate"</p>



<a name="219953496"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953496" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953496">(Dec 15 2020 at 09:27)</a>:</h4>
<p>Sure. Does Rust say that, though? If we're going to have provenance or something like it, that seems like a natural optimization.</p>



<a name="219953600"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953600" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953600">(Dec 15 2020 at 09:28)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953394">said</a>:</p>
<blockquote>
<p>Are you presenting that as a fundamental property of restrict, or just that compilers typically express restrict through provenance?</p>
</blockquote>
<p>I am not saying anything about compilers. Compilers dont explicitly represent anything through provenance, it is only present implicitly.<br>
My claim is that specifying an Abstract Machine with <code>restrict</code> will necessarily involve adding provenance to that abstract machine.</p>



<a name="219953696"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953696" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953696">(Dec 15 2020 at 09:29)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953496">said</a>:</p>
<blockquote>
<p>Sure. Does Rust say that, though? If we're going to have provenance or something like it, that seems like a natural optimization.</p>
</blockquote>
<p>Rust doesn't say anything but raw ptr comparison is safe. so I think we should make it as well-behaved as possible. In particular, if C++ "indeterminate" means <code>undef</code> (which is not clear), then this is not an option for Rust as <code>undef</code> must not be passed to safe code.</p>



<a name="219953708"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953708" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953708">(Dec 15 2020 at 09:29)</a>:</h4>
<p>That does not seem at all inherent to me. Couldn't you just have some optimizations you can apply to restrict and not to non-restrict?</p>



<a name="219953766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953766">(Dec 15 2020 at 09:30)</a>:</h4>
<p>so sure Rust could say "when comparing two ptrs, if their address is the same but their provenance differs, the result is non-detrministically <code>true</code> or <code>false</code>". but that will solve none of our problems here.</p>



<a name="219953850"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953850" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953850">(Dec 15 2020 at 09:30)</a>:</h4>
<p>That wasn't what I suggested.</p>



<a name="219953886"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953886" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953886">(Dec 15 2020 at 09:30)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953708">said</a>:</p>
<blockquote>
<p>That does not seem at all inherent to me. Couldn't you just have some optimizations you can apply to restrict and not to non-restrict?</p>
</blockquote>
<p>sure, but you need to argue for why the optimizations are correct, i.e., are following the as-if rule. that requires defining the abstract machine in a way that the optimizations do not change program behavior. that requires (I claim) making a difference between two pointers that point to the same address. that is provenance.</p>



<a name="219953894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953894">(Dec 15 2020 at 09:30)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953850">said</a>:</p>
<blockquote>
<p>That wasn't what I suggested.</p>
</blockquote>
<p>then I am not sure what you suggested :)</p>



<a name="219953994"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219953994" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219953994">(Dec 15 2020 at 09:31)</a>:</h4>
<p>And I feel like what I suggested is meaningfully different. I was suggesting that if you have provenance, a comparison of two pointers with different provenance could unconditionally optimize to false.</p>



<a name="219954049"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954049" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954049">(Dec 15 2020 at 09:32)</a>:</h4>
<p>I feel we keep talking past each other</p>



<a name="219954066"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954066" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954066">(Dec 15 2020 at 09:32)</a>:</h4>
<p>optimizations are not fundmental, the abstract machine is</p>



<a name="219954087"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954087" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954087">(Dec 15 2020 at 09:32)</a>:</h4>
<p>each abstract machine definition has consequences for which oprimizations you may perform</p>



<a name="219954112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954112">(Dec 15 2020 at 09:32)</a>:</h4>
<p>the ptr equality def.n I proposed above (non-det choice) indeed allows the optimization you propose (compiler replace comparison by false)</p>



<a name="219954145"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954145" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954145">(Dec 15 2020 at 09:33)</a>:</h4>
<p>that's the nature of non-determinism: the compiler may make a choice for you</p>



<a name="219954193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954193">(Dec 15 2020 at 09:33)</a>:</h4>
<p>but this also means that if you perform the same equality test many times, you may get different results</p>



<a name="219954213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954213">(Dec 15 2020 at 09:33)</a>:</h4>
<p>Which is an excellent reason I prefer to avoid non-determinism, when it's possible to give a deterministic answer.</p>



<a name="219954226"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954226" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954226">(Dec 15 2020 at 09:33)</a>:</h4>
<p>and indeed that is unavoidable unless you want to say that the compiler <em>must</em> always perform this optimization</p>



<a name="219954303"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954303" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954303">(Dec 15 2020 at 09:34)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219953109">said</a>:</p>
<blockquote>
<p>WASM doesn't have UB or provenance, so Cranelift itself must not either. Any optimizations that require provenance would have to be layered on top of Cranelift.</p>
</blockquote>
<p>You can say the same thing about most ISAs though. The UB and provenance is all at the compiler IR level, not in the target architecture</p>



<a name="219954306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954306">(Dec 15 2020 at 09:34)</a>:</h4>
<p>so your statement "the compiler should be allowed to perform this optimization" <em>implies</em> non-determinism, I would say</p>



<a name="219954407"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954407" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954407">(Dec 15 2020 at 09:35)</a>:</h4>
<p>I definitely feel we we're talking past each other, then, because I wasn't suggesting it would be optional, no.</p>



<a name="219954414"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954414" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954414">(Dec 15 2020 at 09:35)</a>:</h4>
<p>we can of course also define the abstract machine to deterministically say "if provenance is different, comparison returns false". I mention this option in my blog post. it is impossible to compile this definiton to assembly since we do not have provenance information at runtime.</p>



<a name="219954472"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954472" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954472">(Dec 15 2020 at 09:36)</a>:</h4>
<p>this definition demands that every time two pointers are compared, the compiler must somehow figure out if their provenance is equal. that's impossible.</p>



<a name="219954518"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954518" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954518">(Dec 15 2020 at 09:36)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219954407">said</a>:</p>
<blockquote>
<p>I definitely feel we we're talking past each other, then, because I wasn't suggesting it would be optional, no.</p>
</blockquote>
<p>If it isn't optional, then codegen backends <strong>must</strong> use provenance, which makes cg_clif an incorrect implementation of the rust spec.</p>



<a name="219954557"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954557" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954557">(Dec 15 2020 at 09:36)</a>:</h4>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219954518">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219954407">said</a>:</p>
<blockquote>
<p>I definitely feel we we're talking past each other, then, because I wasn't suggesting it would be optional, no.</p>
</blockquote>
<p>If it isn't optional, then codegen backends <strong>must</strong> use provenance, which makes cg_clif an incorrect implementation of the rust spec.</p>
</blockquote>
<p>it also makes LLVM an incorrect implementation since it doesnt have a way to take into account provenance at runtime.</p>



<a name="219954616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954616">(Dec 15 2020 at 09:37)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I think there must be something <em>really</em> fundamental that I'm missing, because at no point did I bring up runtime. At compile time, you do have provenance.</p>



<a name="219954739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954739">(Dec 15 2020 at 09:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219954616">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> I think there must be something <em>really</em> fundamental that I'm missing, because at no point did I bring up runtime. At compile time, you do have provenance.</p>
</blockquote>
<p>so let me try an example... let's say we move the <code>==</code> into a separate function, i.e., we peform outlining</p>



<a name="219954748"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954748" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954748">(Dec 15 2020 at 09:38)</a>:</h4>
<p>What am I missing here?</p>



<a name="219954778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954778">(Dec 15 2020 at 09:38)</a>:</h4>
<p>now how do you compile that function? it might be called with pointers that differ only in their provenance.</p>



<a name="219954824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954824">(Dec 15 2020 at 09:38)</a>:</h4>
<p>Doesn't the abstract machine have a notion of pointer provenance?</p>



<a name="219954842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954842">(Dec 15 2020 at 09:39)</a>:</h4>
<p>yes</p>



<a name="219954856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954856">(Dec 15 2020 at 09:39)</a>:</h4>
<p>on the abstract machine this is all fine</p>



<a name="219954865"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954865" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954865">(Dec 15 2020 at 09:39)</a>:</h4>
<p>Does that notion not get passed with the pointer?</p>



<a name="219954887"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954887" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954887">(Dec 15 2020 at 09:39)</a>:</h4>
<p>I asked about how you compile it to assembly</p>



<a name="219954908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219954908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219954908">(Dec 15 2020 at 09:39)</a>:</h4>
<p>everything is fine if you only consider the absract machine and never want to run this code on a CPU</p>



<a name="219955051"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955051" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955051">(Dec 15 2020 at 09:40)</a>:</h4>
<p>The fact that that seems incredibly obvious (and the fact that normally I would expect our positions about real CPUs vs abstract machines to be reversed from this) suggests that I'm missing something critical here.</p>



<a name="219955089"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955089" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955089">(Dec 15 2020 at 09:41)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219955051">said</a>:</p>
<blockquote>
<p>The fact that that seems incredibly obvious (and the fact that normally I would expect our positions about real CPUs vs abstract machines to be reversed from this) suggests that I'm missing something critical here.</p>
</blockquote>
<p>yeah that's my thinking, too^^</p>



<a name="219955102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955102">(Dec 15 2020 at 09:41)</a>:</h4>
<p>maybe you should get some sleep, I dont want to keep you awake ;)</p>



<a name="219955130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955130">(Dec 15 2020 at 09:41)</a>:</h4>
<p>I am happy to arrange a call if you want to have a higher-bandwidth discussion about this, with you or the entire lang team or whoever</p>



<a name="219955155"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955155" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955155">(Dec 15 2020 at 09:41)</a>:</h4>
<p>Provenance is a piece of ghost state associated with a pointer. It isn't something statically attached to each pointer.</p>



<a name="219955167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955167">(Dec 15 2020 at 09:41)</a>:</h4>
<p>If the abstract machine has a concept of provenance attached to the pointers, compare the provenance, if not equal constant fold to "false".</p>



<a name="219955241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955241">(Dec 15 2020 at 09:42)</a>:</h4>
<p>(ghost state is state that exists only in an abstract machine but is omitted on a real system)</p>



<a name="219955254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955254">(Dec 15 2020 at 09:42)</a>:</h4>
<p>The provenance isn't necessarily constant</p>



<a name="219955264"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955264" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955264">(Dec 15 2020 at 09:42)</a>:</h4>
<p>(in the abstract machine, provenance is as real as any other state)</p>



<a name="219955315"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955315" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955315">(Dec 15 2020 at 09:43)</a>:</h4>
<p>the thing is, there's another constraint attached with the abstract machine: we want to be able to compile it to assembly. then we need to prove that every time the assembly program does something, the abstract machine could have done the same thing.</p>



<a name="219955336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955336">(Dec 15 2020 at 09:43)</a>:</h4>
<p>but in assembly, <em>there is no provenance</em></p>



<a name="219955368"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955368" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955368">(Dec 15 2020 at 09:43)</a>:</h4>
<p>this state is erased</p>



<a name="219955441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955441">(Dec 15 2020 at 09:44)</a>:</h4>
<p>it's like adding an <code>is_init</code> operation to the abstract machine. this is easy to define in the abstract machine because it always knows explicitly which memory has already been initialized</p>



<a name="219955458"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955458" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955458">(Dec 15 2020 at 09:44)</a>:</h4>
<p>I expect that state to be erased, much as I would then expect the conditional body to disappear and not be represented in the machine code.</p>



<a name="219955461"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955461" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955461">(Dec 15 2020 at 09:44)</a>:</h4>
<blockquote>
<p>compare the provenance, if not equal constant fold to "false".</p>
</blockquote>
<p>This implies that the provenance is known at compile time, and it's not (necessarily). It is a "run time" thing, even though it is ghost state. It is in the run time of the RAM</p>



<a name="219955475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955475">(Dec 15 2020 at 09:44)</a>:</h4>
<p>but it is impossible to test if memory was initialized after the program was compiled to assembly</p>



<a name="219955532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955532">(Dec 15 2020 at 09:45)</a>:</h4>
<p>so <code>is_init</code> can be added to the abstract machine just fine, but it makes it impossible to compile this abstract machine to real code <em>unless we want to add enough instrumentation to the code so that we can test for initializedness at runtime</em></p>



<a name="219955546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955546">(Dec 15 2020 at 09:45)</a>:</h4>
<p><span class="user-mention" data-user-id="239881">@Josh Triplett</span> does the <code>is_init</code> example make sense?</p>



<a name="219955579"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955579" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955579">(Dec 15 2020 at 09:45)</a>:</h4>
<p>I feel like you're using the term "runtime" in a non-standard way.</p>



<a name="219955636"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955636" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955636">(Dec 15 2020 at 09:46)</a>:</h4>
<p>I dont think I am</p>



<a name="219955649"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955649" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955649">(Dec 15 2020 at 09:46)</a>:</h4>
<p>I am literally thinking of the time the program (turned into a bunch of machine code) is being run</p>



<a name="219955716"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955716" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955716">(Dec 15 2020 at 09:46)</a>:</h4>
<p>there's also the "abstract machine runtime", whuch you can think of as "during the execution in Miri", and there <code>is_init</code> is easy to test, but if I used that notion I do agree it would be non-standard ;)</p>



<a name="219955764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955764">(Dec 15 2020 at 09:47)</a>:</h4>
<p>How would you compile the following?</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">equal</span><span class="p">(</span><span class="n">a</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="n">b</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">bool</span> <span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">a</span><span class="w"> </span><span class="o">==</span><span class="w"> </span><span class="n">b</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>It is unknown if the provenance of <code>a</code> and <code>b</code> are the same when compiling this and the provenance also isn't passed as real integers or something like that, yet you want it to return false when the provenance is not equal. There is simply no way to do this.</p>



<a name="219955775"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955775" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955775">(Dec 15 2020 at 09:47)</a>:</h4>
<p>At runtime, we have whatever machine code we generated. If that generated code doesn't care about some state, that state isn't needed at runtime.</p>



<a name="219955810"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955810" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955810">(Dec 15 2020 at 09:47)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219955775">said</a>:</p>
<blockquote>
<p>At runtime, we have whatever machine code we generated. If that generated code doesn't care about some state, that state isn't needed at runtime.</p>
</blockquote>
<p>but you defined it to care about that state by saying that ptr comparison acts on provenance</p>



<a name="219955904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955904">(Dec 15 2020 at 09:48)</a>:</h4>
<p><span class="user-mention" data-user-id="133247">@bjorn3</span> OK, <em>now</em> I get what you're getting at, and I think I understand why it felt like talking past one another.</p>



<a name="219955908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219955908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219955908">(Dec 15 2020 at 09:48)</a>:</h4>
<p>I think it'd be worth going through the <code>is_init</code> example first since I think uninit memory is easier than provenance</p>



<a name="219956155"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956155" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956155">(Dec 15 2020 at 09:51)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> You said we would need some notion of provenance at runtime, which didn't make sense to me. I think that may be because you were reasoning in the opposite direction. I went the other way and assumed that this optimization would mean we'd have to be able to make a proof about the equality of the provenance at compile time, and I was trying to reason from there and see where that led rather than assuming that was impossible.</p>



<a name="219956430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956430">(Dec 15 2020 at 09:53)</a>:</h4>
<p>(I'm not assuming it was possible, either, but I was trying to explore that possibility.)</p>



<a name="219956602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956602">(Dec 15 2020 at 09:55)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219956155">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> You said we would need some notion of provenance at runtime, which didn't make sense to me. I think that may be because you were reasoning in the opposite direction. I went the other way and assumed that this optimization would mean we'd have to be able to make a proof about the equality of the provenance at compile time, and I was trying to reason from there and see where that led rather than assuming that was impossible.</p>
</blockquote>
<p>ah, I see.<br>
I think I have pretty strong intuition that compiler proofs can never be used to <em>guarantee</em> anything. halting problem etc all say this will not work. so the moment you said that provenance <em>determines</em> some runtime observable outcome, I immediately jumped to "well then provenance must exist at runtime as well".<br>
I am clearly too much around people that have these discussions too often. ;)</p>



<a name="219956776"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956776" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956776">(Dec 15 2020 at 09:57)</a>:</h4>
<p>It's not at all unreasonable that you did so, it just felt like you skipped a step, from the perspective of someone who understands formal methods and program proofs in the abstract but doesn't work with them personally very often.</p>



<a name="219956855"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956855" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956855">(Dec 15 2020 at 09:57)</a>:</h4>
<p>hence my suggestion for a higher-bandwidth channel ;) that can help clear up such things much more quickly I think</p>



<a name="219956918"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219956918" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219956918">(Dec 15 2020 at 09:58)</a>:</h4>
<p>I've definitely used the halting problem to do such reasoning, but it isn't immediately clear that that would rule out compile-time pointer provenance.</p>



<a name="219957028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957028">(Dec 15 2020 at 09:59)</a>:</h4>
<p>Yeah, a high-bandwidth conversation might help in a lot of ways, not least of which getting a feel for what feels like a fundamental difference in how we think about the constraints placed on compilers vs the constraints put on code.</p>



<a name="219957029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957029">(Dec 15 2020 at 09:59)</a>:</h4>
<p>actually its probably not even a decidability thing but first and foremost a modularity / separate compilation thing. then it becomes inforamtion-theoretical.</p>



<a name="219957109"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957109" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957109">(Dec 15 2020 at 10:00)</a>:</h4>
<p>i.e., if you take bjorn's example (which I sketched in words before when I mentioned "outlining" but I should have used code), and make that a separate translation unit, then <em>the information simply isn't there</em>, even if you could solve the halting problem.</p>



<a name="219957125"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957125" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957125">(Dec 15 2020 at 10:00)</a>:</h4>
<p><em>That</em> is a very different argument, and yeah, things get less fun when you can't assume all code is in one giant LTO reasoning set. :)</p>



<a name="219957164"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957164" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957164">(Dec 15 2020 at 10:00)</a>:</h4>
<p>now in a discussion with theorists we might say "okay we do whole-program compilation only [aka one giant LTO], what about then", and then we'd probably end up with the halting problem, but I doubt I even need to go so far here ;)</p>



<a name="219957359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957359">(Dec 15 2020 at 10:02)</a>:</h4>
<p>Thinking about it, I do agree that you're right, the deterministic optimization I was imagining would require the compiler to determine arbitrary program behavior at compile time, so that definitely doesn't work.</p>



<a name="219957615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957615">(Dec 15 2020 at 10:05)</a>:</h4>
<p>(At least, in the absence of something like CHERI.)</p>



<a name="219957921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957921">(Dec 15 2020 at 10:08)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219957615">said</a>:</p>
<blockquote>
<p>(At least, in the absence of something like CHERI.)</p>
</blockquote>
<p>(which is basically having [some form of] provenance at runtime)</p>



<a name="219957952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957952">(Dec 15 2020 at 10:08)</a>:</h4>
<p>(<em>nod</em>)</p>



<a name="219957984"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219957984" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219957984">(Dec 15 2020 at 10:09)</a>:</h4>
<p>Definitely going to bed now. :)</p>



<a name="219958024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219958024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219958024">(Dec 15 2020 at 10:09)</a>:</h4>
<p>And thanks again for taking the time to explain concepts more clearly, here and on your blog.</p>



<a name="219960020"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219960020" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219960020">(Dec 15 2020 at 10:30)</a>:</h4>
<p>sure, thanks for taking these ideas seriously and attempting to reconcile them with your existing mental model :)</p>



<a name="219970872"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219970872" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219970872">(Dec 15 2020 at 12:26)</a>:</h4>
<p>(Reading through the IRLO, Reddit and HN discussions)<br>
At this point I have seen people saying "for me it is clear that X is the wrong optimization" for all <code>X ∈ {1,2,3}</code>. It's very amusing to see how people's intuitions contradict each other. This is also exactly what I hoped for: to put into plain sight this lingering contradiction that many weren't really aware of, and to get people to think more deeply about these thorny details of IR semantics. My plan worked out perfectly. :)</p>



<a name="219971469"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219971469" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219971469">(Dec 15 2020 at 12:33)</a>:</h4>
<p>Oh even better, I can see <em>the same person</em> jumping from one value of <code>X</code> to another as their intuition adjusts to new input</p>



<a name="219971654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219971654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219971654">(Dec 15 2020 at 12:34)</a>:</h4>
<p>I need to send this to Gil (Chung-Kil Hur), who came up with these examples... that was 2 years ago or more when I first saw them, and I went through the exact same process that I now see everyone else go through. The credit for this great sequence of exampls entirely goes to him. I hope I made that clear enough in the post.</p>



<a name="219979083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979083">(Dec 15 2020 at 13:35)</a>:</h4>
<blockquote>
<p>non-cache-coherent concurrency</p>
</blockquote>
<p>what does it mean for concurrency not to be cache-coherent?</p>



<a name="219979493"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979493" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979493">(Dec 15 2020 at 13:39)</a>:</h4>
<p>I had a question about the example in the blog but answered it myself - the reason the code is valid is because it modifies through <code>iq</code>, not through <code>ip</code>, and <code>iq</code> is valid for reads and writes</p>



<a name="219979751"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979751" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979751">(Dec 15 2020 at 13:41)</a>:</h4>
<blockquote>
<p>The first “optimization” we will perform is to exploit that if we enter the if body, we have iq == ip, so we can replace all iq by ip. Subsequently the definition of ip is inlined:</p>
</blockquote>
<p>my intuition is telling me this is the wrong optimization, because iq and ip have different provenance: <code>iq</code> is valid for writes but <code>ip</code> is not because it's one-past-the-bounds</p>



<a name="219979890"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979890" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979890">(Dec 15 2020 at 13:42)</a>:</h4>
<p>Because of the ptr2int casts, provenance is lost, so both <code>ip</code> and <code>iq</code> are valid for the writes.</p>



<a name="219979915"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979915" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979915">(Dec 15 2020 at 13:42)</a>:</h4>
<p>this happens <em>before</em> the ptr2int cast</p>



<a name="219979965"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979965" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979965">(Dec 15 2020 at 13:43)</a>:</h4>
<p>or hmm it appears to happen simultaneously?</p>



<a name="219979986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219979986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219979986">(Dec 15 2020 at 13:43)</a>:</h4>
<p>The program starts with <code>uintptr_t ip = (uintptr_t)(p+1);</code> and <code>uintptr_t iq = (uintptr_t)q;</code> which are ptr2int casts.</p>



<a name="219980021"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219980021" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219980021">(Dec 15 2020 at 13:43)</a>:</h4>
<p>ahhh ok thanks</p>



<a name="219980175"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/219980175" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#219980175">(Dec 15 2020 at 13:44)</a>:</h4>
<p>then yes I agree with <span class="user-mention silent" data-user-id="120791">RalfJ</span> it's unclear which of the optimizations is the bug</p>



<a name="220039887"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220039887" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220039887">(Dec 15 2020 at 20:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/219889537">said</a>:</p>
<blockquote>
<p>My reaction to the C example is that signed overflow being UB was a historical artifact of the standard allowing non-two's-complement representations, and now that C2x mandates the two's complement representation, the standard <em>should</em> define signed overflow as wrapping just as it does for unsigned overflow.</p>
</blockquote>
<p>The reason they won't do this is to preserve the optimization turning <code>for (int i = 0; i &lt; N; ++i)</code> into <code>for (ssize_t i = 0; i &lt; N; ++i)</code> and such — replacing <code>int</code> with a register-width variable. Apparently this optimization applied globally is at least a 5% speedup. Rust gets a lot by (more-or-less) forcing <code>usize</code> as the index variable.</p>



<a name="220040286"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040286" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040286">(Dec 15 2020 at 20:48)</a>:</h4>
<p>Do you know why they don't just make <code>int</code> 8 bytes?</p>



<a name="220040393"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040393" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040393">(Dec 15 2020 at 20:49)</a>:</h4>
<p>Breaks code that assumes it is 4 bytes.</p>



<a name="220040396"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040396" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040396">(Dec 15 2020 at 20:49)</a>:</h4>
<p>well, they probably don't want to "just" break the C ABI</p>



<a name="220040540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040540">(Dec 15 2020 at 20:50)</a>:</h4>
<p>even though this was the whole point of making these integral types not commit to a length -_-</p>



<a name="220040595"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040595" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040595">(Dec 15 2020 at 20:51)</a>:</h4>
<p>The standard does not define a length for int. The System V ABI, etc does.</p>



<a name="220040776"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040776" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040776">(Dec 15 2020 at 20:52)</a>:</h4>
<p>well that just pushes the question: why doesn't the x86-64 abi use 8 byte int? I'm pretty sure this exists in one of the variants</p>



<a name="220040832"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220040832" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220040832">(Dec 15 2020 at 20:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/220040776">said</a>:</p>
<blockquote>
<p>well that just pushes the question: why doesn't the x86-64 abi use 8 byte int? I'm pretty sure this exists in one of the variants</p>
</blockquote>
<p><span class="user-mention silent" data-user-id="133247">bjorn3</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real/near/220040393">said</a>:</p>
<blockquote>
<p>Breaks code that assumes it is 4 bytes.</p>
</blockquote>
<p>this</p>



<a name="220041031"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220041031" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220041031">(Dec 15 2020 at 20:54)</a>:</h4>
<p>so it's not necessarily 4 bytes but it can't be anything else</p>



<a name="220041047"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer%20provenance%20is%20real/near/220041047" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pointer.20provenance.20is.20real.html#220041047">(Dec 15 2020 at 20:54)</a>:</h4>
<p>what a lovely state of affairs</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>